Documentation
¶
Overview ¶
package: jwt / authn type: adapter (JWKS key source) job: fetch and refresh a JSON Web Key Set — the key source for a rotating issuer limits: the only network access in this backend; Authenticate only reads the cached set
package: jwt / authn type: adapter job: authenticate a bearer token by verifying it against a configured algorithm and key limits: the key is static config or a refreshed JWKS (-> jwks.go); no network on the request path
The token's own "alg" header is never trusted: verification is asked only for the algorithm config names, so "none" or an unlisted one is refused before the signature is even checked — a JWKS-sourced key does not relax this.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Auth ¶
type Auth struct {
// contains filtered or unexported fields
}
Auth is the JWT backend: an algorithm, a key source (static or JWKS), which claim names the account, and an audience/issuer to hold a token to (empty skips the check — an operator opts in by setting it).
func New ¶
New builds the backend from "algorithm" (one of allowedAlgorithms) and exactly one key source: "key" — PEM public key preferred (a leaked config then cannot mint tokens, apikey's own standard for secrets), or a raw HMAC secret — or "jwks_url" for a rotating issuer, refreshed every "jwks_refresh" (default 5m). "account_claim" (default "sub"), "audience" and "issuer" (default empty, meaning unchecked) are optional.
func (*Auth) Authenticate ¶
Authenticate verifies token against the algorithm and key (by "kid", for a JWKS source — reading its cached set, never fetching), checks exp/nbf/iat and any configured audience/issuer, and resolves the account claim to Principal.Account. Any failure is ErrUnauthenticated — this backend states no opinion beyond "who".
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
package: jwttest / authn type: test-support job: the jwt backend's conformance setup hook and token fixtures, beside the backend limits: a test helper; only the conformance driver imports it (-> adapters/auth)
|
package: jwttest / authn type: test-support job: the jwt backend's conformance setup hook and token fixtures, beside the backend limits: a test helper; only the conformance driver imports it (-> adapters/auth) |