Documentation
¶
Overview ¶
Package jwt reads JSON Web Tokens without verifying them. patty has no key to check a signature with and never claims to: what it takes from a token is who issued it, to whom, and until when, so a provider can tell its own tokens from everyone else's and say what a leaked one is. Bare tokens of no known issuer are not findings; a provider decides what to report.
Index ¶
Constants ¶
const Prefix = "eyJ"
Prefix is how the base64url of a JSON object starts, and so every JWT.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Claims ¶
type Claims struct {
Issuer string
Subject string
Audience []string
// Expires and IssuedAt are zero when the token has no exp or iat.
Expires time.Time
IssuedAt time.Time
Raw map[string]any
Header map[string]any
}
Claims is the decoded payload of a token, with the registered claims picked out and everything kept in Raw.
func Decode ¶
Decode splits a token into header, payload and signature and decodes the first two. The signature is kept out: it is not checked. A string that is not three base64url parts with JSON objects in the first two is not a token.
Source Files