Documentation
¶
Overview ¶
Package jwkutil converts between JSON Web Keys and Go public keys, and computes RFC 7638 thumbprints.
Both directions live here on purpose. The encode direction serves the JWKS endpoint and the parse direction serves DPoP proof validation, and keeping them together makes the round trip testable as a single property.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrUnsupportedKey = errors.New("jwkutil: unsupported key type") ErrPrivateKeyMaterial = errors.New("jwkutil: jwk contains private key material") ErrWeakKey = errors.New("jwkutil: key below minimum strength") )
Sentinel errors.
Functions ¶
func Thumbprint ¶
Thumbprint returns the base64url-encoded SHA-256 RFC 7638 thumbprint.
The hash covers only the required members, in lexicographic order, with no whitespace. Optional members such as kid must not affect the result, or a key that later gains a kid would stop matching tokens bound to it.
Types ¶
type JWK ¶
type JWK struct {
KTY string `json:"kty"`
Use string `json:"use,omitempty"`
KID string `json:"kid,omitempty"`
ALG string `json:"alg,omitempty"`
N string `json:"n,omitempty"` // RSA modulus
E string `json:"e,omitempty"` // RSA exponent
CRV string `json:"crv,omitempty"` // EC or OKP curve
X string `json:"x,omitempty"` // EC x coordinate, or OKP public key
Y string `json:"y,omitempty"` // EC y coordinate
}
JWK is a JSON Web Key. Only the public members are modelled; private members are detected during parsing and rejected.
Source Files