Documentation
¶
Overview ¶
Package accesstoken wraps a jwt.Provider and a dataprotection.Provider to issue opaque encrypted access tokens of the form "pat.<base64url(AES-GCM (claims))>" while still parsing plain JWTs through the inner provider.
Every pat. token expires. Sign keeps a caller-supplied exp; otherwise it adds iat, nbf and an exp after WithTokenExpiry, or the inner provider's TokenExpiry, and fails when neither is set. ParseToken rejects pat. tokens without exp unless WithAllowNoExpiry is set to migrate perpetual tokens issued by older versions.
dp, err := dataprotection.NewSymmetric(secret)
if err != nil {
return err
}
p := accesstoken.New(dp, nil, accesstoken.WithTokenExpiry(time.Hour))
token, err := p.Sign(ctx, jwt.MapClaims{"sub": "user"})
if err != nil {
return err
}
claims, err := p.ParseToken(ctx, token, nil)
Index ¶
- Constants
- func New(dp dataprotection.Provider, provider jwt.Provider, opts ...Option) jwt.Provider
- type Option
- type Provider
- func (p *Provider) GetRevocation() jwt.Revocation
- func (p *Provider) Issuer() string
- func (p *Provider) ParseToken(ctx context.Context, token string, cfg *jwt.VerifyConfig) (jwt.MapClaims, error)
- func (p *Provider) PublicKey() crypto.PublicKey
- func (p *Provider) SetRevocation(r jwt.Revocation)
- func (p *Provider) Sign(ctx context.Context, claims jwt.MapClaims) (string, error)
- func (p *Provider) TokenExpiry() time.Duration
Examples ¶
Constants ¶
const (
// TokenPrefix is the prefix of the opaque access tokens issued by Sign
TokenPrefix = "pat."
)
Variables ¶
This section is empty.
Functions ¶
func New ¶
New returns a Provider that issues pat. tokens protected by dp and delegates other tokens to the optional inner provider. A nil dp is allowed, but then pat. tokens can be neither issued nor parsed.
Example ¶
ExampleNew compiles the usage sample from doc.go.
package main
import (
"context"
"fmt"
"time"
"github.com/effective-security/xpki/dataprotection"
"github.com/effective-security/xpki/jwt"
"github.com/effective-security/xpki/jwt/accesstoken"
)
func main() {
ctx := context.Background()
dp, err := dataprotection.NewSymmetric([]byte("secret"))
if err != nil {
panic(err)
}
p := accesstoken.New(dp, nil, accesstoken.WithTokenExpiry(time.Hour))
token, err := p.Sign(ctx, jwt.MapClaims{"sub": "user"})
if err != nil {
panic(err)
}
claims, err := p.ParseToken(ctx, token, nil)
if err != nil {
panic(err)
}
fmt.Println(claims.String("sub"), claims.Time("exp") != nil)
}
Output: user true
Types ¶
type Option ¶ added in v0.29.306
type Option func(*Provider)
Option configures a Provider.
func WithAllowNoExpiry ¶ added in v0.29.306
func WithAllowNoExpiry() Option
WithAllowNoExpiry makes ParseToken accept pat. tokens without an exp claim, such as tokens issued before Sign added one (XPKI-078). Use it only to migrate existing perpetual tokens; revocation is still checked.
func WithTokenExpiry ¶ added in v0.29.306
WithTokenExpiry sets the lifetime Sign gives a token whose claims have no exp. It takes precedence over the inner provider's TokenExpiry. Zero keeps the inner provider's value; a negative value makes Sign fail.
type Provider ¶
Provider of Access Token
func (*Provider) GetRevocation ¶ added in v0.22.184
func (p *Provider) GetRevocation() jwt.Revocation
GetRevocation returns the revocation checker used for pat. tokens
func (*Provider) ParseToken ¶
func (p *Provider) ParseToken(ctx context.Context, token string, cfg *jwt.VerifyConfig) (jwt.MapClaims, error)
ParseToken parses JWT Token with data protection. A pat. token must have an exp claim unless WithAllowNoExpiry is set; an unparsable exp is always rejected.
func (*Provider) PublicKey ¶ added in v0.11.0
PublicKey returns the public key of an asymmetric data protection provider, or nil for a symmetric or nil one.
func (*Provider) SetRevocation ¶ added in v0.22.184
func (p *Provider) SetRevocation(r jwt.Revocation)
SetRevocation installs the revocation checker used for pat. tokens, and forwards it to the wrapped jwt.Provider so that plain JWTs are checked against the same revocation list.
func (*Provider) Sign ¶ added in v0.11.0
Sign returns an encrypted pat. token for the claims. Caller-supplied exp, iat and nbf are kept and normalized to NumericDate; an unparsable one, or a zero time, is an error, see jwt.MapClaims.NormalizeTimeClaims. Without exp, the token expires after TokenExpiry, and iat and nbf are added when absent; Sign fails if TokenExpiry is not positive. The claims map is not modified.
func (*Provider) TokenExpiry ¶ added in v0.11.0
TokenExpiry returns the lifetime Sign gives a token without exp: the WithTokenExpiry value if set, else the inner provider's TokenExpiry, else 0. A negative WithTokenExpiry value is reported as 0.
Source Files