Documentation
¶
Overview ¶
Package cwt decodes a CWT (CBOR Web Token, RFC 8392) — the CBOR-native counterpart of a JWT, used for OAuth / proof-of-possession on constrained / IoT devices. It is the missing member of PromptZero's token-decoder set (jwt, paseto, macaroon).
A CWT is a CBOR claims map, usually wrapped in a single-recipient COSE message (COSE_Sign1 / COSE_Mac0, or COSE_Encrypt0 when the claims are encrypted), and optionally carried under the CWT CBOR tag (61). This decoder unwraps that envelope, reports the signing algorithm from the COSE protected header, and surfaces the standard claims (iss / sub / aud / exp / nbf / iat / cti, IANA "CWT Claims") with the timestamps rendered both as epoch seconds and RFC 3339.
It does NOT verify the signature or MAC — that needs the issuer's key, which an operator inspecting a captured token won't have — so the result carries an explicit "not verified" note. Encrypted (COSE_Encrypt0) payloads can't be decoded without the key and are reported as such.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CWT ¶
type CWT struct {
CWTTagged bool `json:"cwt_tagged"` // wrapped in the CWT tag (61)
COSEType string `json:"cose_type"` // COSE_Sign1 / COSE_Mac0 / COSE_Encrypt0 / unsecured / …
Algorithm string `json:"algorithm,omitempty"`
AlgorithmID *int64 `json:"algorithm_id,omitempty"`
PayloadEncrypted bool `json:"payload_encrypted"` // COSE_Encrypt0 — claims not decodable
Claims *Claims `json:"claims,omitempty"`
Note string `json:"note"`
}
CWT is the decoded token.
type Claims ¶
type Claims struct {
Issuer string `json:"iss,omitempty"`
Subject string `json:"sub,omitempty"`
Audience string `json:"aud,omitempty"`
ExpiresAt *Time `json:"exp,omitempty"`
NotBefore *Time `json:"nbf,omitempty"`
IssuedAt *Time `json:"iat,omitempty"`
CWTIDHex string `json:"cti_hex,omitempty"`
// Additional holds any claim outside the standard seven, keyed by its
// integer or text label, with a short value description.
Additional map[string]string `json:"additional,omitempty"`
}
Claims is the decoded CWT claims set (RFC 8392 §3.1.1).
Source Files