Documentation
¶
Overview ¶
Package jwtutils signs and verifies JWTs with typed private claims.
Index ¶
- Variables
- type CachedKeyProvider
- type KeyProvider
- type PrivateClaimDecoder
- type Signer
- type Standard
- type Verified
- type Verifier
- func (v *Verifier[T]) Verify(encoded string) (Verified[T], error)
- func (v *Verifier[T]) WithAudience(audience string) *Verifier[T]
- func (v *Verifier[T]) WithClockSkew(skew time.Duration) *Verifier[T]
- func (v *Verifier[T]) WithIssuer(issuer string) *Verifier[T]
- func (v *Verifier[T]) WithKeySet(set jwk.Set) *Verifier[T]
- func (v *Verifier[T]) WithRequiredClaims(names ...string) *Verifier[T]
Constants ¶
This section is empty.
Variables ¶
var ( ErrMissingKey = errors.New("jwtutils: signing key is required") ErrMissingKeySet = errors.New("jwtutils: verification key set is empty") // ErrReservedClaim reports a private claim that uses a registered name. ErrReservedClaim = errors.New("jwtutils: private claim collides with a registered claim") // ErrWeakHMACKey reports an HMAC key shorter than the algorithm minimum. ErrWeakHMACKey = errors.New("jwtutils: HMAC key too short") )
Errors returned by the signer and verifier.
Functions ¶
This section is empty.
Types ¶
type CachedKeyProvider ¶
type CachedKeyProvider struct {
// contains filtered or unexported fields
}
CachedKeyProvider caches keys for a fixed time.
func NewCachedKeyProvider ¶
func NewCachedKeyProvider(inner KeyProvider, ttl time.Duration) *CachedKeyProvider
NewCachedKeyProvider builds a key cache with the given lifetime.
func (*CachedKeyProvider) Invalidate ¶
func (c *CachedKeyProvider) Invalidate()
Invalidate clears both cached entries.
func (*CachedKeyProvider) SignKey ¶
SignKey returns the cached signing key, refreshing it when expired.
func (*CachedKeyProvider) VerifyKeySet ¶
VerifyKeySet returns the cached public key set under the same TTL.
func (*CachedKeyProvider) WithClock ¶
func (c *CachedKeyProvider) WithClock(now func() time.Time) *CachedKeyProvider
WithClock overrides the time source (tests).
type KeyProvider ¶
type KeyProvider interface {
// SignKey returns the current signing key.
SignKey(ctx context.Context) (jwk.Key, error)
// VerifyKeySet returns the published public keys.
VerifyKeySet(ctx context.Context) (jwk.Set, error)
}
KeyProvider supplies the signing key and public verification keys.
type PrivateClaimDecoder ¶
PrivateClaimDecoder customizes reconstruction of typed private claims.
type Signer ¶
type Signer[T any] struct { // contains filtered or unexported fields }
Signer creates signed JWTs with typed private claims.
func (*Signer[T]) WithAudience ¶
WithAudience sets the default audience claim.
func (*Signer[T]) WithIssuer ¶
WithIssuer sets the default issuer claim.
type Standard ¶
type Standard struct {
Issuer string
Subject string
Audience []string
ExpiresAt time.Time
IssuedAt time.Time
NotBefore time.Time
JWTID string
}
Standard carries the registered claims managed by the Signer and surfaced by the Verifier.
type Verifier ¶
type Verifier[T any] struct { // contains filtered or unexported fields }
Verifier checks JWTs and decodes their typed private claims.
func NewVerifier ¶
NewVerifier builds a verifier with a key and signature algorithm.
func (*Verifier[T]) WithAudience ¶
WithAudience requires a matching audience claim.
func (*Verifier[T]) WithClockSkew ¶
WithClockSkew sets the allowed clock difference for time claims.
func (*Verifier[T]) WithIssuer ¶
WithIssuer requires a matching issuer claim.
func (*Verifier[T]) WithKeySet ¶
WithKeySet configures verification with a JWKS key set.
func (*Verifier[T]) WithRequiredClaims ¶
WithRequiredClaims requires the named registered claims.
Source Files