Documentation
¶
Index ¶
Constants ¶
const ( // Generic Claims ClaimIss = "iss" ClaimClientId = "client_id" ClaimApplicationId = "application_id" ClaimAud = "aud" ClaimNbf = "nbf" ClaimAzp = "azp" ClaimExp = "exp" ClaimIat = "iat" ClaimSub = "sub" )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ConsumerAssertion ¶
type ConsumerAssertion struct {
ApplicationID string // Mapped from 'application_id'
ClientID string // Mapped from 'client_id'
Subscriber string // Mapped from 'sub' or 'azp'
Iss string // Mapped from 'iss'
Aud []string // Mapped from 'aud'
Exp int64 // Mapped from 'exp'
Iat int64 // Mapped from 'iat'
}
ConsumerAssertion represents the parsed and validated M2M token claims.
func GetConsumerJwtFromToken ¶
func GetConsumerJwtFromToken(jwtConfig *configs.JWTConfig, trustUpstream bool, r *http.Request) (*ConsumerAssertion, error)
GetConsumerJwtFromToken validates and parses JWT token from HTTP request
func GetConsumerJwtFromTokenWithValidator ¶
func GetConsumerJwtFromTokenWithValidator(jwtConfig *configs.JWTConfig, trustUpstream bool, r *http.Request, validator *TokenValidator) (*ConsumerAssertion, error)
GetConsumerJwtFromTokenWithValidator validates and parses JWT token with optional cached validator
type TokenValidator ¶
type TokenValidator struct {
// contains filtered or unexported fields
}
TokenValidator handles JWT token validation with auto-refreshing JWKS. The JWKS is automatically refreshed in the background to handle key rotation.
func NewTokenValidator ¶
func NewTokenValidator(ctx context.Context, jwksURL string, environment string) (*TokenValidator, error)
NewTokenValidator creates a new TokenValidator instance with automatic JWKS refresh. The provided context controls the lifecycle of the background refresh goroutine. When the context is cancelled, the refresh goroutine will stop.
Implementation uses keyfunc.NewDefaultOverrideCtx with a custom HTTP client that:
- Filters x5c certificates from JWKS (prevents parsing errors)
- Fetches JWKS immediately (fail-fast validation)
- Starts background goroutine to refresh JWKS every hour
- Handles automatic key rotation
- Refreshes on unknown kid (rate-limited to prevent abuse)
This ensures:
- Service won't start if JWKS is unavailable (when trustUpstream=false)
- Automatic key rotation handling without manual intervention
- High availability during key rotation periods
- No x5c certificate parsing errors
Source Files