Documentation
¶
Overview ¶
Package token checks access tokens. With them, a server admits only clients that a token service has admitted.
A token is a JWT signed with EdDSA (Ed25519) or ES256. Its cnf claim (RFC 7800) holds the client's Ed25519 public key, which must equal the key the client logs in with. A token is therefore useless without the private key. The server learns the token service's public keys from a JWKS, fetched from a URL or read from a file.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// JWKSURL is the URL of the token service's JWKS. Exactly one of JWKSURL and JWKSFile is required.
JWKSURL string
// JWKSFile is a file with the JWKS, read once, for tests and for networks without access to the token service.
JWKSFile string
// Issuer is the required iss claim.
Issuer string
// Audience must be the aud claim, or one of its values.
Audience string
// Leeway allows for clock differences in exp and nbf.
Leeway time.Duration
// HTTPClient fetches the JWKS. Nil means a client with a timeout of 10 s.
HTTPClient *http.Client
// Now returns the current time. Nil means time.Now.
Now func() time.Time
}
Config configures a Verifier.
type DeniedError ¶
type DeniedError struct {
Reason string
}
DeniedError reports why a token was rejected.
func (*DeniedError) Error ¶
func (e *DeniedError) Error() string
type Grant ¶ added in v0.3.0
type Grant struct {
Expires time.Time
// Owner is the token's sub: the owner of the client's key and of its slot. Empty if the token has no sub.
Owner string
}
Grant is what a valid token says about its client.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks tokens. It is safe for concurrent use.
func New ¶
New returns a Verifier. It reads JWKSFile right away. A JWKS URL is fetched on the first token.
func (*Verifier) Verify ¶
Verify checks a token for a client that logs in with the Ed25519 key publicKey. A rejected token returns a *DeniedError.
func (*Verifier) VerifyUnbound ¶ added in v0.3.0
VerifyUnbound checks a token without requiring that it is bound to a key. Only requests that need no proof of a key accept such a token, e.g. looking up the owner's slot. A rejected token returns a *DeniedError.
Source Files