jwt: github.com/gbrlsnchs/jwt Index | Files | Directories

package jwt

import "github.com/gbrlsnchs/jwt"

Package jwt is a JSON Web Token signer, verifier and validator.

Index

Package Files

algorithm.go audience.go doc.go ecdsa_sha.go ed25519.go hash_pool.go header.go hmac_sha.go json.go none.go payload.go raw_token.go resolver.go rsa_sha.go sign.go time.go validators.go verify.go

Variables

var (
    // ErrECDSANilPrivKey is the error for trying to sign a JWT with a nil private key.
    ErrECDSANilPrivKey = internal.NewError("jwt: ECDSA private key is nil")
    // ErrECDSANilPubKey is the error for trying to verify a JWT with a nil public key.
    ErrECDSANilPubKey = internal.NewError("jwt: ECDSA public key is nil")
    // ErrECDSAVerification is the error for an invalid ECDSA signature.
    ErrECDSAVerification = internal.NewError("jwt: ECDSA verification failed")
)
var (
    // ErrEd25519NilPrivKey is the error for trying to sign a JWT with a nil private key.
    ErrEd25519NilPrivKey = internal.NewError("jwt: Ed25519 private key is nil")
    // ErrEd25519NilPubKey is the error for trying to verify a JWT with a nil public key.
    ErrEd25519NilPubKey = internal.NewError("jwt: Ed25519 public key is nil")
    // ErrEd25519Verification is the error for when verification with Ed25519 fails.
    ErrEd25519Verification = internal.NewError("jwt: Ed25519 verification failed")
)
var (
    // ErrHMACMissingKey is the error for trying to sign or verify a JWT with an empty key.
    ErrHMACMissingKey = internal.NewError("jwt: HMAC key is empty")
    // ErrHMACVerification is the error for an invalid signature.
    ErrHMACVerification = internal.NewError("jwt: HMAC verification failed")
)
var (
    // ErrRSANilPrivKey is the error for trying to sign a JWT with a nil private key.
    ErrRSANilPrivKey = internal.NewError("jwt: RSA private key is nil")
    // ErrRSANilPubKey is the error for trying to verify a JWT with a nil public key.
    ErrRSANilPubKey = internal.NewError("jwt: RSA public key is nil")
    // ErrRSAVerification is the error for an invalid RSA signature.
    ErrRSAVerification = internal.NewError("jwt: RSA verification failed")
)
var (
    // ErrAudValidation is the error for an invalid "aud" claim.
    ErrAudValidation = internal.NewError("jwt: aud claim is invalid")
    // ErrExpValidation is the error for an invalid "exp" claim.
    ErrExpValidation = internal.NewError("jwt: exp claim is invalid")
    // ErrIatValidation is the error for an invalid "iat" claim.
    ErrIatValidation = internal.NewError("jwt: iat claim is invalid")
    // ErrIssValidation is the error for an invalid "iss" claim.
    ErrIssValidation = internal.NewError("jwt: iss claim is invalid")
    // ErrJtiValidation is the error for an invalid "jti" claim.
    ErrJtiValidation = internal.NewError("jwt: jti claim is invalid")
    // ErrNbfValidation is the error for an invalid "nbf" claim.
    ErrNbfValidation = internal.NewError("jwt: nbf claim is invalid")
    // ErrSubValidation is the error for an invalid "sub" claim.
    ErrSubValidation = internal.NewError("jwt: sub claim is invalid")
)
var ErrAlgValidation = internal.NewError(`invalid "alg" field`)

ErrAlgValidation indicates an incoming JWT's "alg" field mismatches the Validator's.

var ErrMalformed = internal.NewError("jwt: malformed token")

ErrMalformed indicates a token doesn't have a valid format, as per the RFC 7519.

var ErrNotJSONObject = errors.New("jwt: payload is not a valid JSON object")

ErrNotJSONObject is the error for when a JWT payload is not a JSON object.

func ECDSAPrivateKey Uses

func ECDSAPrivateKey(priv *ecdsa.PrivateKey) func(*ECDSASHA)

ECDSAPrivateKey is an option to set a private key to the ECDSA-SHA algorithm.

func ECDSAPublicKey Uses

func ECDSAPublicKey(pub *ecdsa.PublicKey) func(*ECDSASHA)

ECDSAPublicKey is an option to set a public key to the ECDSA-SHA algorithm.

func Ed25519PrivateKey Uses

func Ed25519PrivateKey(priv ed25519.PrivateKey) func(*Ed25519)

Ed25519PrivateKey is an option to set a private key to the Ed25519 algorithm.

func Ed25519PublicKey Uses

func Ed25519PublicKey(pub ed25519.PublicKey) func(*Ed25519)

Ed25519PublicKey is an option to set a public key to the Ed25519 algorithm.

func RSAPrivateKey Uses

func RSAPrivateKey(priv *rsa.PrivateKey) func(*RSASHA)

RSAPrivateKey is an option to set a private key to the RSA-SHA algorithm.

func RSAPublicKey Uses

func RSAPublicKey(pub *rsa.PublicKey) func(*RSASHA)

RSAPublicKey is an option to set a public key to the RSA-SHA algorithm.

func Sign Uses

func Sign(payload interface{}, alg Algorithm, opts ...SignOption) ([]byte, error)

Sign signs a payload with alg.

func ValidateHeader Uses

func ValidateHeader(rt *RawToken) error

ValidateHeader checks whether the algorithm contained in the JOSE header is the same used by the algorithm.

type Algorithm Uses

type Algorithm interface {
    Name() string
    Sign(headerPayload []byte) ([]byte, error)
    Size() int
    Verify(headerPayload, sig []byte) error
}

Algorithm is an algorithm for both signing and verifying a JWT.

func None Uses

func None() Algorithm

None returns a dull, unsecured algorithm.

type Audience Uses

type Audience []string

Audience is a special claim that may either be a single string or an array of strings, as per the RFC 7519.

func (Audience) MarshalJSON Uses

func (a Audience) MarshalJSON() ([]byte, error)

MarshalJSON implements a marshaling function for "aud" claim.

func (*Audience) UnmarshalJSON Uses

func (a *Audience) UnmarshalJSON(b []byte) error

UnmarshalJSON implements an unmarshaling function for "aud" claim.

type ECDSASHA Uses

type ECDSASHA struct {
    // contains filtered or unexported fields
}

ECDSASHA is an algorithm that uses ECDSA to sign SHA hashes.

func NewES256 Uses

func NewES256(opts ...func(*ECDSASHA)) *ECDSASHA

NewES256 creates a new algorithm using ECDSA and SHA-256.

func NewES384 Uses

func NewES384(opts ...func(*ECDSASHA)) *ECDSASHA

NewES384 creates a new algorithm using ECDSA and SHA-384.

func NewES512 Uses

func NewES512(opts ...func(*ECDSASHA)) *ECDSASHA

NewES512 creates a new algorithm using ECDSA and SHA-512.

func (*ECDSASHA) Name Uses

func (es *ECDSASHA) Name() string

Name returns the algorithm's name.

func (*ECDSASHA) Sign Uses

func (es *ECDSASHA) Sign(headerPayload []byte) ([]byte, error)

Sign signs headerPayload using the ECDSA-SHA algorithm.

func (*ECDSASHA) Size Uses

func (es *ECDSASHA) Size() int

Size returns the signature's byte size.

func (*ECDSASHA) Verify Uses

func (es *ECDSASHA) Verify(headerPayload, sig []byte) (err error)

Verify verifies a signature based on headerPayload using ECDSA-SHA.

type Ed25519 Uses

type Ed25519 struct {
    // contains filtered or unexported fields
}

Ed25519 is an algorithm that uses EdDSA to sign SHA-512 hashes.

func NewEd25519 Uses

func NewEd25519(opts ...func(*Ed25519)) *Ed25519

NewEd25519 creates a new algorithm using EdDSA and SHA-512.

func (*Ed25519) Name Uses

func (*Ed25519) Name() string

Name returns the algorithm's name.

func (*Ed25519) Sign Uses

func (ed *Ed25519) Sign(headerPayload []byte) ([]byte, error)

Sign signs headerPayload using the Ed25519 algorithm.

func (*Ed25519) Size Uses

func (*Ed25519) Size() int

Size returns the signature byte size.

func (*Ed25519) Verify Uses

func (ed *Ed25519) Verify(payload, sig []byte) (err error)

Verify verifies a payload and a signature.

type HMACSHA Uses

type HMACSHA struct {
    // contains filtered or unexported fields
}

HMACSHA is an algorithm that uses HMAC to sign SHA hashes.

func NewHS256 Uses

func NewHS256(key []byte) *HMACSHA

NewHS256 creates a new algorithm using HMAC and SHA-256.

func NewHS384 Uses

func NewHS384(key []byte) *HMACSHA

NewHS384 creates a new algorithm using HMAC and SHA-384.

func NewHS512 Uses

func NewHS512(key []byte) *HMACSHA

NewHS512 creates a new algorithm using HMAC and SHA-512.

func (*HMACSHA) Name Uses

func (hs *HMACSHA) Name() string

Name returns the algorithm's name.

func (*HMACSHA) Sign Uses

func (hs *HMACSHA) Sign(headerPayload []byte) ([]byte, error)

Sign signs headerPayload using the HMAC-SHA algorithm.

func (*HMACSHA) Size Uses

func (hs *HMACSHA) Size() int

Size returns the signature's byte size.

func (*HMACSHA) Verify Uses

func (hs *HMACSHA) Verify(headerPayload, sig []byte) (err error)

Verify verifies a signature based on headerPayload using HMAC-SHA.

type Header struct {
    Algorithm   string `json:"alg,omitempty"`
    ContentType string `json:"cty,omitempty"`
    KeyID       string `json:"kid,omitempty"`
    Type        string `json:"typ,omitempty"`
}

Header is a JOSE header narrowed down to the JWT specification from RFC 7519.

Parameters are ordered according to the RFC 7515.

func Verify Uses

func Verify(token []byte, alg Algorithm, payload interface{}, opts ...VerifyOption) (Header, error)

Verify verifies a token's signature using alg. Before verification, opts is iterated and each option in it is run.

type Payload Uses

type Payload struct {
    Issuer         string   `json:"iss,omitempty"`
    Subject        string   `json:"sub,omitempty"`
    Audience       Audience `json:"aud,omitempty"`
    ExpirationTime *Time    `json:"exp,omitempty"`
    NotBefore      *Time    `json:"nbf,omitempty"`
    IssuedAt       *Time    `json:"iat,omitempty"`
    JWTID          string   `json:"jti,omitempty"`
}

Payload is a JWT payload according to the RFC 7519.

type RSASHA Uses

type RSASHA struct {
    // contains filtered or unexported fields
}

RSASHA is an algorithm that uses RSA to sign SHA hashes.

func NewPS256 Uses

func NewPS256(opts ...func(*RSASHA)) *RSASHA

NewPS256 creates a new algorithm using RSA-PSS and SHA-256.

func NewPS384 Uses

func NewPS384(opts ...func(*RSASHA)) *RSASHA

NewPS384 creates a new algorithm using RSA-PSS and SHA-384.

func NewPS512 Uses

func NewPS512(opts ...func(*RSASHA)) *RSASHA

NewPS512 creates a new algorithm using RSA-PSS and SHA-512.

func NewRS256 Uses

func NewRS256(opts ...func(*RSASHA)) *RSASHA

NewRS256 creates a new algorithm using RSA and SHA-256.

func NewRS384 Uses

func NewRS384(opts ...func(*RSASHA)) *RSASHA

NewRS384 creates a new algorithm using RSA and SHA-384.

func NewRS512 Uses

func NewRS512(opts ...func(*RSASHA)) *RSASHA

NewRS512 creates a new algorithm using RSA and SHA-512.

func (*RSASHA) Name Uses

func (rs *RSASHA) Name() string

Name returns the algorithm's name.

func (*RSASHA) Sign Uses

func (rs *RSASHA) Sign(headerPayload []byte) ([]byte, error)

Sign signs headerPayload using either RSA-SHA or RSA-PSS-SHA algorithms.

func (*RSASHA) Size Uses

func (rs *RSASHA) Size() int

Size returns the signature's byte size.

func (*RSASHA) Verify Uses

func (rs *RSASHA) Verify(headerPayload, sig []byte) (err error)

Verify verifies a signature based on headerPayload using either RSA-SHA or RSA-PSS-SHA.

type RawToken Uses

type RawToken struct {
    // contains filtered or unexported fields
}

RawToken is a representation of a parsed JWT string.

type Resolver Uses

type Resolver interface {
    Resolve(Header) error
}

Resolver is an Algorithm that needs to set some variables based on a Header before performing signing and verification.

type SignOption Uses

type SignOption func(*Header)

SignOption is a functional option for signing.

func ContentType Uses

func ContentType(cty string) SignOption

ContentType sets the "cty" claim for a Header before signing.

func KeyID Uses

func KeyID(kid string) SignOption

KeyID sets the "kid" claim for a Header before signing.

type Time Uses

type Time struct {
    time.Time
}

Time is the allowed format for time, as per the RFC 7519.

func NumericDate Uses

func NumericDate(tt time.Time) *Time

NumericDate is a resolved Unix time.

func (Time) MarshalJSON Uses

func (t Time) MarshalJSON() ([]byte, error)

MarshalJSON implements a marshaling function for time-related claims.

func (*Time) UnmarshalJSON Uses

func (t *Time) UnmarshalJSON(b []byte) error

UnmarshalJSON implements an unmarshaling function for time-related claims.

type Validator Uses

type Validator func(*Payload) error

Validator is a function that validates a Payload pointer.

func AudienceValidator Uses

func AudienceValidator(aud Audience) Validator

AudienceValidator validates the "aud" claim. It checks if at least one of the audiences in the JWT's payload is listed in aud.

func ExpirationTimeValidator Uses

func ExpirationTimeValidator(now time.Time) Validator

ExpirationTimeValidator validates the "exp" claim.

func IDValidator Uses

func IDValidator(jti string) Validator

IDValidator validates the "jti" claim.

func IssuedAtValidator Uses

func IssuedAtValidator(now time.Time) Validator

IssuedAtValidator validates the "iat" claim.

func IssuerValidator Uses

func IssuerValidator(iss string) Validator

IssuerValidator validates the "iss" claim.

func NotBeforeValidator Uses

func NotBeforeValidator(now time.Time) Validator

NotBeforeValidator validates the "nbf" claim.

func SubjectValidator Uses

func SubjectValidator(sub string) Validator

SubjectValidator validates the "sub" claim.

type VerifyOption Uses

type VerifyOption func(*RawToken) error

VerifyOption is a functional option for verifying.

func ValidatePayload Uses

func ValidatePayload(pl *Payload, vds ...Validator) VerifyOption

ValidatePayload runs validators against a Payload after it's been decoded.

Directories

PathSynopsis
internal
jwtutil

Package jwt imports 17 packages (graph) and is imported by 6 packages. Updated 2019-10-25. Refresh now. Tools for package owners.