Documentation
¶
Overview ¶
Package setjwt parses and validates RFC 8417 Security Event Tokens. It has no authsome dependencies. Errors are the RFC 8935 sentinels so a caller can turn a failure straight into a push-endpoint error body.
Index ¶
Constants ¶
const MaxJTILength = 255
MaxJTILength bounds the jti we are willing to store as a dedupe key.
Variables ¶
var ( ErrInvalidRequest = errors.New("setjwt: invalid_request") ErrInvalidKey = errors.New("setjwt: invalid_key") ErrInvalidIssuer = errors.New("setjwt: invalid_issuer") ErrInvalidAudience = errors.New("setjwt: invalid_audience") )
RFC 8935 error sentinels. ErrCode turns one into its wire code.
ErrKeyUnavailable says the key set could not be loaded, so the token was never actually checked. It is deliberately NOT one of the RFC 8935 codes: none of them describe "our side could not look", and every one of them tells a well-behaved transmitter that the token is wrong and retrying is pointless. A caller that sees this must answer with a 5xx and let the transmitter deliver the same SET again.
A KeyResolver signals it by returning an error that wraps this sentinel; Validate passes such an error through instead of flattening it into ErrInvalidKey. A resolver that just cannot find the kid keeps returning a plain error and still gets invalid_key, which is the right permanent answer for a token naming a key the issuer does not publish.
Functions ¶
Types ¶
type KeyResolver ¶
KeyResolver hands back the public key for a kid.
type Options ¶
type Options struct {
Issuer string
Audience string
Keys KeyResolver
Now func() time.Time
MaxAge time.Duration
ClockSkew time.Duration
MaxEvents int
}
Options configures Validate. Every field is required.
Source Files