jwt

package
v0.0.0-...-ed3efbc Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 6, 2023 License: Apache-2.0 Imports: 20 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	SigningMethodNone = jose.SignatureAlgorithm("none")
	// This key should be use to correctly sign and verify alg:none JWT tokens
	UnsafeAllowNoneSignatureType unsafeNoneMagicConstant = "none signing method allowed"

	JWTHeaderType      = jose.HeaderKey("typ")
	JWTHeaderTypeValue = "JWT"
)
View Source 
const (
	ValidationErrorMalformed        uint32 = 1 << iota // Token is malformed
	ValidationErrorUnverifiable                        // Token could not be verified because of signing problems
	ValidationErrorSignatureInvalid                    // Signature validation failed

	// Standard Claim validation errors
	ValidationErrorAudience      // AUD validation failed
	ValidationErrorExpired       // EXP validation failed
	ValidationErrorIssuedAt      // IAT validation failed
	ValidationErrorIssuer        // ISS validation failed
	ValidationErrorNotValidYet   // NBF validation failed
	ValidationErrorId            // JTI validation failed
	ValidationErrorClaimsInvalid // Generic claims validation error
)

Validation provides a backwards compatible error definition from `jwt-go` to `go-jose`. The sourcecode was taken from https://github.com/dgrijalva/jwt-go/blob/master/errors.go

> The errors that might occur when parsing and validating a token

Variables

View Source 
var SHA256HashSize = crypto.SHA256.Size()
View Source 
var TimeFunc = time.Now

Functions

func Copy 

func Copy(elements map[string]interface{}) (result map[string]interface{})

Copy will copy all elements in a map and return a new representational map

func Filter 

func Filter(elements map[string]interface{}, keys ...string) map[string]interface{}

Filter will filter out elements based on keys in a given input map na key-slice

func ToString 

func ToString(i interface{}) string

ToString will return a string representation of a map

func ToTime 

func ToTime(i interface{}) time.Time

ToTime will try to convert a given input to a time.Time structure

Types

type Claims 

type Claims interface {
	Valid() error
}

Claims is a port from https://github.com/dgrijalva/jwt-go/blob/master/claims.go including its validation methods, which are not available in go-jose library

> For a type to be a Claims object, it must just have a Valid method that determines if the token is invalid for any supported reason

type DefaultSigner 

type DefaultSigner struct {
	GetPrivateKey GetPrivateKeyFunc
}

DefaultSigner is responsible for generating and validating JWT challenges

func (*DefaultSigner) Decode 

func (j *DefaultSigner) Decode(ctx context.Context, token string) (*Token, error)

Decode will decode a JWT token

func (*DefaultSigner) Generate 

func (j *DefaultSigner) Generate(ctx context.Context, claims MapClaims, header Mapper) (string, string, error)

Generate generates a new authorize code or returns an error. set secret

func (*DefaultSigner) GetSignature 

func (j *DefaultSigner) GetSignature(ctx context.Context, token string) (string, error)

GetSignature will return the signature of a token

func (*DefaultSigner) GetSigningMethodLength 

func (j *DefaultSigner) GetSigningMethodLength(ctx context.Context) int

GetSigningMethodLength will return the length of the signing method

func (*DefaultSigner) Hash 

func (j *DefaultSigner) Hash(ctx context.Context, in []byte) ([]byte, error)

Hash will return a given hash based on the byte input or an error upon fail

func (*DefaultSigner) Validate 

func (j *DefaultSigner) Validate(ctx context.Context, token string) (string, error)

Validate validates a token and returns its signature or an error if the token is not valid.

type GetPrivateKeyFunc 

type GetPrivateKeyFunc func(ctx context.Context) (interface{}, error)

type Headers 

type Headers struct {
	Extra map[string]interface{} `json:"extra"`
}

Headers is the jwt headers

func NewHeaders 

func NewHeaders() *Headers

func (*Headers) Add 

func (h *Headers) Add(key string, value interface{})

Add will add a key-value pair to the extra field

func (*Headers) Get 

func (h *Headers) Get(key string) interface{}

Get will get a value from the extra field based on a given key

func (*Headers) ToMap 

func (h *Headers) ToMap() map[string]interface{}

ToMap will transform the headers to a map structure

func (Headers) ToMapClaims 

func (h Headers) ToMapClaims() MapClaims

ToMapClaims will return a jwt-go MapClaims representation

type IDTokenClaims 

type IDTokenClaims struct {
	JTI                                 string                 `json:"jti"`
	Issuer                              string                 `json:"iss"`
	Subject                             string                 `json:"sub"`
	Audience                            []string               `json:"aud"`
	Nonce                               string                 `json:"nonce"`
	ExpiresAt                           time.Time              `json:"exp"`
	IssuedAt                            time.Time              `json:"iat"`
	RequestedAt                         time.Time              `json:"rat"`
	AuthTime                            time.Time              `json:"auth_time"`
	AccessTokenHash                     string                 `json:"at_hash"`
	AuthenticationContextClassReference string                 `json:"acr"`
	AuthenticationMethodsReferences     []string               `json:"amr"`
	CodeHash                            string                 `json:"c_hash"`
	Extra                               map[string]interface{} `json:"ext"`
}

IDTokenClaims represent the claims used in open id connect requests

func (*IDTokenClaims) Add 

func (c *IDTokenClaims) Add(key string, value interface{})

Add will add a key-value pair to the extra field

func (*IDTokenClaims) Get 

func (c *IDTokenClaims) Get(key string) interface{}

Get will get a value from the extra field based on a given key

func (*IDTokenClaims) ToMap 

func (c *IDTokenClaims) ToMap() map[string]interface{}

ToMap will transform the headers to a map structure

func (IDTokenClaims) ToMapClaims 

func (c IDTokenClaims) ToMapClaims() MapClaims

ToMapClaims will return a jwt-go MapClaims representation

type JWTClaims 

type JWTClaims struct {
	Subject    string
	Issuer     string
	Audience   []string
	JTI        string
	IssuedAt   time.Time
	NotBefore  time.Time
	ExpiresAt  time.Time
	Scope      []string
	Extra      map[string]interface{}
	ScopeField JWTScopeFieldEnum
}

JWTClaims represent a token's claims.

func (*JWTClaims) Add 

func (c *JWTClaims) Add(key string, value interface{})

Add will add a key-value pair to the extra field

func (*JWTClaims) FromMap 

func (c *JWTClaims) FromMap(m map[string]interface{})

FromMap will set the claims based on a mapping

func (*JWTClaims) FromMapClaims 

func (c *JWTClaims) FromMapClaims(mc MapClaims)

FromMapClaims will populate claims from a jwt-go MapClaims representation

func (JWTClaims) Get 

func (c JWTClaims) Get(key string) interface{}

Get will get a value from the extra field based on a given key

func (*JWTClaims) ToMap 

func (c *JWTClaims) ToMap() map[string]interface{}

ToMap will transform the headers to a map structure

func (JWTClaims) ToMapClaims 

func (c JWTClaims) ToMapClaims() MapClaims

ToMapClaims will return a jwt-go MapClaims representation

func (*JWTClaims) With 

func (c *JWTClaims) With(expiry time.Time, scope, audience []string) JWTClaimsContainer

func (*JWTClaims) WithDefaults 

func (c *JWTClaims) WithDefaults(iat time.Time, issuer string) JWTClaimsContainer

func (*JWTClaims) WithScopeField 

func (c *JWTClaims) WithScopeField(scopeField JWTScopeFieldEnum) JWTClaimsContainer

type JWTClaimsContainer 

type JWTClaimsContainer interface {
	// With returns a copy of itself with expiresAt, scope, audience set to the given values.
	With(expiry time.Time, scope, audience []string) JWTClaimsContainer

	// WithDefaults returns a copy of itself with issuedAt and issuer set to the given default values. If those
	// values are already set in the claims, they will not be updated.
	WithDefaults(iat time.Time, issuer string) JWTClaimsContainer

	// WithScopeField configures how a scope field should be represented in JWT.
	WithScopeField(scopeField JWTScopeFieldEnum) JWTClaimsContainer

	// ToMapClaims returns the claims as a github.com/dgrijalva/jwt-go.MapClaims type.
	ToMapClaims() MapClaims
}

type JWTClaimsDefaults 

type JWTClaimsDefaults struct {
	ExpiresAt time.Time
	IssuedAt  time.Time
	Issuer    string
	Scope     []string
}

type JWTScopeFieldEnum 

type JWTScopeFieldEnum int

Enum for different types of scope encoding. 

const (
	JWTScopeFieldUnset JWTScopeFieldEnum = iota
	JWTScopeFieldList
	JWTScopeFieldString
	JWTScopeFieldBoth
)

type Keyfunc 

type Keyfunc func(*Token) (interface{}, error)

Parse methods use this callback function to supply the key for verification. The function receives the parsed, but unverified Token. This allows you to use properties in the Header of the token (such as `kid`) to identify which key to use.

type MapClaims 

type MapClaims map[string]interface{}

MapClaims provides backwards compatible validations not available in `go-jose`. It was taken from [here](https://raw.githubusercontent.com/form3tech-oss/jwt-go/master/map_claims.go).

Claims type that uses the map[string]interface{} for JSON decoding This is the default claims type if you don't supply one

func (MapClaims) UnmarshalJSON 

func (m MapClaims) UnmarshalJSON(b []byte) error

func (MapClaims) Valid 

func (m MapClaims) Valid() error

Validates time based claims "exp, iat, nbf". There is no accounting for clock skew. As well, if any of the above claims are not in the token, it will still be considered a valid claim.

func (MapClaims) VerifyAudience 

func (m MapClaims) VerifyAudience(cmp string, req bool) bool

Compares the aud claim against cmp. If required is false, this method will return true if the value matches or is unset

func (MapClaims) VerifyExpiresAt 

func (m MapClaims) VerifyExpiresAt(cmp int64, req bool) bool

Compares the exp claim against cmp. If required is false, this method will return true if the value matches or is unset

func (MapClaims) VerifyIssuedAt 

func (m MapClaims) VerifyIssuedAt(cmp int64, req bool) bool

Compares the iat claim against cmp. If required is false, this method will return true if the value matches or is unset

func (MapClaims) VerifyIssuer 

func (m MapClaims) VerifyIssuer(cmp string, req bool) bool

Compares the iss claim against cmp. If required is false, this method will return true if the value matches or is unset

func (MapClaims) VerifyNotBefore 

func (m MapClaims) VerifyNotBefore(cmp int64, req bool) bool

Compares the nbf claim against cmp. If required is false, this method will return true if the value matches or is unset

type Mapper 

type Mapper interface {
	ToMap() map[string]interface{}
	Add(key string, value interface{})
	Get(key string) interface{}
}

Mapper is the interface used internally to map key-value pairs

type Signer 

type Signer interface {
	Generate(ctx context.Context, claims MapClaims, header Mapper) (string, string, error)
	Validate(ctx context.Context, token string) (string, error)
	Hash(ctx context.Context, in []byte) ([]byte, error)
	Decode(ctx context.Context, token string) (*Token, error)
	GetSignature(ctx context.Context, token string) (string, error)
	GetSigningMethodLength(ctx context.Context) int
}

type Token 

type Token struct {
	Header map[string]interface{} // The first segment of the token
	Claims MapClaims              // The second segment of the token
	Method jose.SignatureAlgorithm
	// contains filtered or unexported fields
}

Token represets a JWT Token This token provide an adaptation to transit from [jwt-go](https://github.com/dgrijalva/jwt-go) to [go-jose](https://github.com/square/go-jose) It provides method signatures compatible with jwt-go but implemented using go-json

func NewWithClaims 

func NewWithClaims(method jose.SignatureAlgorithm, claims MapClaims) *Token

NewWithClaims creates an unverified Token with the given claims and signing method

func Parse 

func Parse(tokenString string, keyFunc Keyfunc) (*Token, error)

func ParseWithClaims 

func ParseWithClaims(rawToken string, claims MapClaims, keyFunc Keyfunc) (*Token, error)

Parse, validate, and return a token. keyFunc will receive the parsed token and should return the key for validating. If everything is kosher, err will be nil

func (*Token) SignedString 

func (t *Token) SignedString(k interface{}) (rawToken string, err error)

SignedString provides a compatible `jwt-go` Token.SignedString method

> Get the complete, signed token

func (*Token) Valid 

func (t *Token) Valid() bool

Valid informs if the token was verified against a given verification key and claims are valid

type ValidationError 

type ValidationError struct {
	Inner  error  // stores the error returned by external dependencies, i.e.: KeyFunc
	Errors uint32 // bitfield.  see ValidationError... constants
	// contains filtered or unexported fields
}

The error from Parse if token is not valid

func (ValidationError) Error 

func (e ValidationError) Error() string

Validation error is an error type

func (*ValidationError) Has 

func (e *ValidationError) Has(verr uint32) bool

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.