jwt

package
v0.4.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 11, 2026 License: MIT Imports: 14 Imported by: 0

Documentation

Overview

Package jwt verifies the compact RS256 identity tokens of OpenID Connect providers. It supports the single algorithm Auth-All accepts.

Index

Constants

This section is empty.

Variables

View Source
var ErrInvalidToken = errors.New("authall/jwt: the identity token is invalid")

ErrInvalidToken reports a token that fails any validation step.

Functions

This section is empty.

Types

type Claims

type Claims struct {
	Issuer        string `json:"iss"`
	Subject       string `json:"sub"`
	Audience      any    `json:"aud"`
	Expiry        int64  `json:"exp"`
	IssuedAt      int64  `json:"iat"`
	Nonce         string `json:"nonce"`
	Email         string `json:"email"`
	EmailVerified any    `json:"email_verified"`
	Name          string `json:"name"`
	Picture       string `json:"picture"`
}

Claims are the identity token claims Auth-All reads.

func (Claims) VerifiedEmail

func (c Claims) VerifiedEmail() bool

VerifiedEmail reports the boolean form of the email_verified claim, which some providers send as a string.

type KeySet

type KeySet struct {
	// contains filtered or unexported fields
}

KeySet fetches and caches the public keys of one provider.

func NewKeySet

func NewKeySet(url string, client *http.Client) *KeySet

NewKeySet returns a key set for a JWKS URL.

func (*KeySet) Verify

func (k *KeySet) Verify(ctx context.Context, token string, v Verification) (*Claims, error)

Verify checks the signature and the required claims of an identity token.

type Verification

type Verification struct {
	Issuer   string
	Audience string
	Nonce    string
	Now      time.Time
	// Leeway absorbs small clock differences.
	Leeway time.Duration
}

Verification describes the required checks.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL