jwt

Documentation

Index

• Constants
• Variables
• func DecodeSegment(seg string) ([]byte, error)
• func EncodeSegment(seg []byte) string
• type Header
• type IClaims
• type Option
• type Signer
• type SigningMethod
  • func GetSigningMethod(alg Signer) SigningMethod
  • func NewSigningMethodHMAC() SigningMethod
• type SigningMethodHMAC
  • func (m *SigningMethodHMAC) Alg() Signer
  • func (m *SigningMethodHMAC) Sign(signingString string, keyBytes []byte) (string, error)
  • func (m *SigningMethodHMAC) Verify(signingString, signature string, keyBytes []byte) error
• type StandardClaims
  • func (c StandardClaims) Valid() error
  • func (c *StandardClaims) VerifyAudience(cmp string, req bool) bool
  • func (c *StandardClaims) VerifyExpiresAt(cmp int64, req bool) bool
  • func (c *StandardClaims) VerifyIssuedAt(cmp int64, req bool) bool
  • func (c *StandardClaims) VerifyIssuer(cmp string, req bool) bool
  • func (c *StandardClaims) VerifyNotBefore(cmp int64, req bool) bool
• type Token
  • func New[C IClaims](claims C, opts ...Option[C]) *Token[C]
  • func Parse[T IClaims](tokenString string) (*Token[T], error)
  • func (t *Token[C]) SignedString() (string, error)
  • func (t *Token[C]) SigningString() (string, error)
• type ValidationError
  • func NewValidationError(errorText string, errorFlags uint32) *ValidationError
  • func (e ValidationError) Error() string

Constants

const (
	ValidationErrorMalformed        uint32 = 1 << iota // Token is malformed
	ValidationErrorUnverifiable                        // Token could not be verified because of signing problems
	ValidationErrorSignatureInvalid                    // Signature validation failed

	// ValidationErrorAudience Standard Claim validation errors
	ValidationErrorAudience      // AUD validation failed
	ValidationErrorExpired       // EXP validation failed
	ValidationErrorIssuedAt      // IAT validation failed
	ValidationErrorIssuer        // ISS validation failed
	ValidationErrorNotValidYet   // NBF validation failed
	ValidationErrorId            // JTI validation failed
	ValidationErrorClaimsInvalid // Generic claims validation error
)

The errors that might occur when parsing and validating a token

Variables

var (
	ErrInvalidKey       = errors.New("key is invalid")
	ErrInvalidKeyType   = errors.New("key is of invalid type")
	ErrHashUnavailable  = errors.New("the requested hash function is unavailable")
	ErrSignatureInvalid = errors.New("signature is invalid")
)

Error constants

var TimeFunc = time.Now

Functions

func DecodeSegment

func DecodeSegment(seg string) ([]byte, error)

DecodeSegment Decode JWT specific base64url encoding with padding stripped

func EncodeSegment

func EncodeSegment(seg []byte) string

EncodeSegment Encode JWT specific base64url encoding with padding stripped

Types

type Header

type Header struct {
	Typ string `json:"typ"`
	Alg Signer `json:"alg"`
}

type IClaims

type IClaims interface {
	Valid() error

	GetSigningKey() []byte
	SkipClaimsValidation() bool
}

type Option

type Option[C IClaims] func(token *Token[C])

type Signer

type Signer string

const HS256 Signer = "HS256"

type SigningMethod

type SigningMethod interface {
	Verify(signingString, signature string, key []byte) error // Returns nil if signature is valid
	Sign(signingString string, key []byte) (string, error)    // Returns encoded signature or error
	Alg() Signer                                              // returns the alg identifier for this method (example: 'HS256')
}

SigningMethod Implement SigningMethod to add new methods for signing or verifying tokens.

func GetSigningMethod

func GetSigningMethod(alg Signer) SigningMethod

func NewSigningMethodHMAC

func NewSigningMethodHMAC() SigningMethod

type SigningMethodHMAC

type SigningMethodHMAC struct {
	Name Signer
	Hash crypto.Hash
}

func (*SigningMethodHMAC) Alg

func (m *SigningMethodHMAC) Alg() Signer

func (*SigningMethodHMAC) Sign

func (m *SigningMethodHMAC) Sign(signingString string, keyBytes []byte) (string, error)

Sign Implements the Sign method from SigningMethod for this signing method. Key must be []byte

func (*SigningMethodHMAC) Verify

func (m *SigningMethodHMAC) Verify(signingString, signature string, keyBytes []byte) error

Verify the signature of HSXXX tokens. Returns nil if the signature is valid.

type StandardClaims

type StandardClaims struct {
	Audience  string `json:"aud,omitempty"`
	ExpiresAt int64  `json:"exp,omitempty"`
	Id        string `json:"jti,omitempty"`
	IssuedAt  int64  `json:"iat,omitempty"`
	Issuer    string `json:"iss,omitempty"`
	NotBefore int64  `json:"nbf,omitempty"`
	Subject   string `json:"sub,omitempty"`
}

StandardClaims Structured version of Claims Section, as referenced at https://tools.ietf.org/html/rfc7519#section-4.1 See examples for how to use this with your own claim types

func (StandardClaims) Valid

func (c StandardClaims) Valid() error

Valid Validates time based claims "exp, iat, nbf". There is no accounting for clock skew. As well, if any of the above claims are not in the token, it will still be considered a valid claim.

func (*StandardClaims) VerifyAudience

func (c *StandardClaims) VerifyAudience(cmp string, req bool) bool

VerifyAudience Compares the aud claim against cmp. If required is false, this method will return true if the value matches or is unset

func (*StandardClaims) VerifyExpiresAt

func (c *StandardClaims) VerifyExpiresAt(cmp int64, req bool) bool

VerifyExpiresAt Compares the exp claim against cmp. If required is false, this method will return true if the value matches or is unset

func (*StandardClaims) VerifyIssuedAt

func (c *StandardClaims) VerifyIssuedAt(cmp int64, req bool) bool

VerifyIssuedAt Compares the iat claim against cmp. If required is false, this method will return true if the value matches or is unset

func (*StandardClaims) VerifyIssuer

func (c *StandardClaims) VerifyIssuer(cmp string, req bool) bool

VerifyIssuer Compares the iss claim against cmp. If required is false, this method will return true if the value matches or is unset

func (*StandardClaims) VerifyNotBefore

func (c *StandardClaims) VerifyNotBefore(cmp int64, req bool) bool

VerifyNotBefore Compares the nbf claim against cmp. If required is false, this method will return true if the value matches or is unset

type Token

type Token[C IClaims] struct {
	Raw           string        // The raw token.  Populated when you Parse a token
	SigningMethod SigningMethod // The signing method used or to be used
	Header        Header        // The first segment of the token
	Claims        C             // The second segment of the token
	Signature     string        // The third segment of the token.  Populated when you Parse a token
	Valid         bool          // Is the token valid?  Populated when you Parse/Verify a token
}

func New

func New[C IClaims](claims C, opts ...Option[C]) *Token[C]

func Parse

func Parse[T IClaims](tokenString string) (*Token[T], error)

func (*Token[C]) SignedString

func (t *Token[C]) SignedString() (string, error)

SignedString Get the complete, signed token

func (*Token[C]) SigningString

func (t *Token[C]) SigningString() (string, error)

SigningString Generate the signing string. This is the most expensive part of the whole deal. Unless you need this for something special, just go straight for the SignedString.

type ValidationError

type ValidationError struct {
	Inner  error  // stores the error returned by external dependencies, i.e.: KeyFunc
	Errors uint32 // bitfield.  see ValidationError... constants
	// contains filtered or unexported fields
}

ValidationError The error from Parse if token is not valid

func NewValidationError

func NewValidationError(errorText string, errorFlags uint32) *ValidationError

NewValidationError Helper for constructing a ValidationError with a string error message

func (ValidationError) Error

func (e ValidationError) Error() string

Validation error is an error type