jwtauth

README

jwtauth

jwtauth handle multiple keys for jwt token signing and verification. It also support key deprecation and backward compatibility for verifying old tokens. Tokens are signed by choosing a random key that is not marked as deprecated. Deprecated keys can only verify old tokens and not sign new ones.

Documentation

Index

• Variables
• type Auth
  • func New[CustomClaims any](expireSeconds int, keys ...*Key) *Auth[CustomClaims]
  • func NewWithClock[CustomClaims any](clock Clock, expireSeconds int, keys ...*Key) *Auth[CustomClaims]
  • func (auth *Auth[CustomClaims]) GenerateToken(customClaims *CustomClaims) (token string, expiresAt time.Time, err error)
  • func (auth *Auth[CustomClaims]) ParseToken(tokenString string) (*CustomClaims, error)
• type Clock
• type Key
  • func NewECDSAKey(kid string, key *ecdsa.PrivateKey, signingMethod *jwt.SigningMethodECDSA) *Key
  • func NewHMACKey(kid string, key []byte, signingMethod *jwt.SigningMethodHMAC) *Key
  • func NewRSAKey(kid string, key *rsa.PrivateKey, signingMethod *jwt.SigningMethodRSA) *Key
  • func (key *Key) Deprecated() *Key
• type TimeClock
  • func (t TimeClock) Now() time.Time

Variables

var (
	ErrInvalidKid = errors.New("invalid kid")
	ErrUnsetKid   = errors.New("unset kid")
)

Types

type Auth

type Auth[CustomClaims any] struct {
	// contains filtered or unexported fields
}

func New

func New[CustomClaims any](
	expireSeconds int,
	keys ...*Key,
) *Auth[CustomClaims]

func NewWithClock

func NewWithClock[CustomClaims any](
	clock Clock,
	expireSeconds int,
	keys ...*Key,
) *Auth[CustomClaims]

func (*Auth[CustomClaims]) GenerateToken

func (auth *Auth[CustomClaims]) GenerateToken(
	customClaims *CustomClaims,
) (token string, expiresAt time.Time, err error)

func (*Auth[CustomClaims]) ParseToken

func (auth *Auth[CustomClaims]) ParseToken(
	tokenString string,
) (*CustomClaims, error)

type Clock

type Clock interface {
	Now() time.Time
}

type Key

type Key struct {
	Kid           string            // jwt 'kid' header value to identify the correct key for verifying
	SigningKey    any               // key used for signing: symmetric methods have the same signing and verifying key
	VerifyingKey  any               // key used for verifying: symmetric methods have the same signing and verifying key
	SigningMethod jwt.SigningMethod // key signing method
	// contains filtered or unexported fields
}

func NewECDSAKey

func NewECDSAKey(
	kid string,
	key *ecdsa.PrivateKey,
	signingMethod *jwt.SigningMethodECDSA,
) *Key

func NewHMACKey

func NewHMACKey(
	kid string,
	key []byte,
	signingMethod *jwt.SigningMethodHMAC,
) *Key

func NewRSAKey

func NewRSAKey(
	kid string,
	key *rsa.PrivateKey,
	signingMethod *jwt.SigningMethodRSA,
) *Key

func (*Key) Deprecated

func (key *Key) Deprecated() *Key

Mark the key as deprecated. Deprecated keys are used only for verifying and not signing.

type TimeClock

type TimeClock struct{}

func (TimeClock) Now

func (t TimeClock) Now() time.Time