Documentation
¶
Index ¶
Constants ¶
View Source
const ( // DefaultMetadataTTL is how long a fetched authorization-server metadata // document is reused before it is fetched again. DefaultMetadataTTL = time.Hour // DefaultJWKSTTL is how long a fetched key set is reused before it is // fetched again. DefaultJWKSTTL = 15 * time.Minute // DefaultClockSkew tolerates small clock differences between the issuer and // the verifier. DefaultClockSkew = time.Minute )
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Claims ¶
type Claims struct {
Issuer string
Subject string
Username string
Audience string
Scopes []string
ClientID string
Expiry time.Time
}
Claims are the verified claims of an OAuth access token.
type Options ¶
type Options struct {
// HTTPClient fetches metadata and key sets. It defaults to a client with a
// 10 second timeout.
HTTPClient *http.Client
// Now overrides the clock; tests use it to exercise expiry and rotation.
Now func() time.Time
// MetadataTTL and JWKSTTL override the cache lifetimes.
MetadataTTL time.Duration
JWKSTTL time.Duration
// ClockSkew overrides the tolerated clock difference.
ClockSkew time.Duration
// RefreshCooldown bounds how often an unknown key triggers a key-set
// refresh. It defaults to refreshCooldown.
RefreshCooldown time.Duration
}
Options configures a Verifier. The zero value uses the defaults.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier verifies access tokens from configured issuers.
func (*Verifier) Verify ¶
func (v *Verifier) Verify(ctx context.Context, token, issuer, audience, requiredScope string) (*Claims, error)
Verify validates token as an access token issued by issuer for audience, with requiredScope present when non-empty. It fetches and caches the issuer's metadata and key set.
Source Files
Click to show internal directories.
Click to hide internal directories.