Documentation
¶
Overview ¶
Package jarm implements JWT Secured Authorization Response Mode (RFC 9101).
JARM allows the authorization response to be encoded as a JWT, providing integrity protection and authentication of the authorization response.
Supported response modes:
- query.jwt: JWT in the query string
- fragment.jwt: JWT in the fragment
- form_post.jwt: JWT via form post
The JWT contains the standard authorization response claims (code, state, etc.) plus standard JWT claims (iss, aud, exp, iat).
Index ¶
- Constants
- type Config
- type Plugin
- func (p *Plugin) Category() storm.PluginCategory
- func (p *Plugin) Contribute(ctx context.Context, cfg *protocol.DiscoveryConfiguration)
- func (p *Plugin) Name() string
- func (p *Plugin) Register(r chi.Router)
- func (p *Plugin) Requires() []string
- func (p *Plugin) SignAuthResponse(ctx context.Context, params map[string]string, clientID string, ...) (string, error)
Constants ¶
const DefaultJARMLifetime = 5 * time.Minute
DefaultJARMLifetime is the default lifetime for JARM JWTs. Per RFC 9101 §5.1, the JWT should have a short expiration.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// KeyStore provides signing keys for JWT creation.
KeyStore storm.KeyStore
// IssuerFn provides the issuer URL from the request context.
IssuerFn shared.IssuerFromRequest
// Lifetime is the JWT expiration duration.
// Defaults to DefaultJARMLifetime if not set.
Lifetime time.Duration
}
Config holds the dependencies for the JARM plugin.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin implements JARM (JWT Secured Authorization Response Mode).
func NewWithConfig ¶
NewWithConfig creates a new JARM plugin with explicit config.
func (*Plugin) Category ¶
func (p *Plugin) Category() storm.PluginCategory
Category returns CategoryStandard — JARM is an optional extension.
func (*Plugin) Contribute ¶
func (p *Plugin) Contribute(ctx context.Context, cfg *protocol.DiscoveryConfiguration)
Contribute returns discovery fields for JARM.
func (*Plugin) Register ¶
Register is a no-op for the JARM plugin. JARM is integrated via the JARMSigner interface.
func (*Plugin) SignAuthResponse ¶
func (p *Plugin) SignAuthResponse(ctx context.Context, params map[string]string, clientID string, signingAlg string) (string, error)
SignAuthResponse implements the JARMSigner interface. It creates a signed JWT containing the authorization response parameters.
Per RFC 9101 §5.1, the JWT contains:
- iss: the authorization server's issuer URL
- aud: the client_id
- exp: expiration time
- iat: issued at time
- All authorization response parameters (code, state, etc.)
The context is used to derive the issuer URL. If no issuer is found in the context, an error is returned.
Source Files