jws

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 8, 2023 License: MIT Imports: 16 Imported by: 2

Documentation

Overview

Package jws handles JSON Web Signatures defined in RFC 7515.

Index

Examples

Constants

This section is empty.

Variables

View Source 
var UnsecureAnyAlgorithm = unsecureAnyAlgorithmVerifier{}

UnsecureAnyAlgorithm is an AlgorithmVerifier that accepts any algorithm.

Functions

This section is empty.

Types

type AlgorithmVerifier added in v0.1.0 

type AlgorithmVerifier interface {
	VerifyAlgorithm(ctx context.Context, alg jwa.SignatureAlgorithm) error
}

AlgorithmVerifier verifies the algorithm used for signing.

type AllowedAlgorithms added in v0.1.0 

type AllowedAlgorithms []jwa.SignatureAlgorithm

func (AllowedAlgorithms) VerifyAlgorithm added in v0.1.0 

func (a AllowedAlgorithms) VerifyAlgorithm(ctx context.Context, alg jwa.SignatureAlgorithm) error

type FindKeyFunc 

type FindKeyFunc func(ctx context.Context, protected, unprotected *Header) (key sig.SigningKey, err error)

FindKeyFunc is an adapter to allow the use of ordinary functions as KeyFinder.

func (FindKeyFunc) FindKey 

func (f FindKeyFunc) FindKey(ctx context.Context, protected, unprotected *Header) (key sig.SigningKey, err error)
type Header struct {
	// Raw is the raw data of JSON-decoded JOSE header.
	// JSON numbers are decoded as json.Number to avoid data loss.
	Raw map[string]any
	// contains filtered or unexported fields
}

Header is a decoded JSON Object Signing and Encryption (JOSE) Header.

func NewHeader added in v0.0.5 

func NewHeader() *Header

NewHeader returns a new Header.

func (*Header) Algorithm 

func (h *Header) Algorithm() jwa.SignatureAlgorithm

Algorithm is RFC 7515 Section 4.1.1. "alg" (Algorithm) Header Parameter.

func (*Header) Base64 added in v0.0.5 

func (h *Header) Base64() bool

Base64 gets RFC 7797 Section 3. The "b64" Header Parameter.

func (*Header) ContentType 

func (h *Header) ContentType() string

ContentType is RFC 7517 Section 4.1.10. "cty" (Content Type) Header Parameter.

func (*Header) Critical 

func (h *Header) Critical() []string

Critical gets RFC 7515 Section 4.1.11. "crit" (Critical) Header Parameter.

func (*Header) JWK 

func (h *Header) JWK() *jwk.Key

JWK is RFC 7515 Section 4.1.3. "jwk" (JSON Web Key) Header Parameter.

func (*Header) JWKSetURL 

func (h *Header) JWKSetURL() *url.URL

JWKSetURL is RFC 7515 Section 4.1.2. "jku" (JWK Set URL) Header Parameter.

func (*Header) KeyID 

func (h *Header) KeyID() string

KeyID is RFC 7515 Section 4.1.4. "kid" (Key ID) Header Parameter.

func (*Header) MarshalJSON 

func (h *Header) MarshalJSON() ([]byte, error)

func (*Header) SetAlgorithm 

func (h *Header) SetAlgorithm(alg jwa.SignatureAlgorithm)

SetAlgorithm sets RFC 7515 Section 4.1.1. "alg" (Algorithm) Header Parameter.

func (*Header) SetBase64 added in v0.0.5 

func (h *Header) SetBase64(b64 bool)

SetBase64 sets RFC 7797 Section 3. The "b64" Header Parameter. If b64 is false, it adds "b64" into "crit" (Critical) Header Parameter.

func (*Header) SetContentType 

func (h *Header) SetContentType(cty string)

SetContentType sets RFC 7517 Section 4.1.10. "cty" (Content Type) Header Parameter.

func (*Header) SetCritical 

func (h *Header) SetCritical(crit []string)

SetCritical sets RFC 7515 Section 4.1.11. "crit" (Critical) Header Parameter.

func (*Header) SetJWK 

func (h *Header) SetJWK(jwk *jwk.Key)

SetJWK sets RFC 7515 Section 4.1.3. "jwk" (JSON Web Key) Header Parameter.

func (*Header) SetJWKSetURL 

func (h *Header) SetJWKSetURL(jku *url.URL)

SetJWKSetURL sets RFC 7515 Section 4.1.2. "jku" (JWK Set URL) Header Parameter.

func (*Header) SetKeyID 

func (h *Header) SetKeyID(kid string)

SetKeyID sets RFC 7515 Section 4.1.4. "kid" (Key ID) Header Parameter.

func (*Header) SetType 

func (h *Header) SetType(typ string)

SetType sets RFC 7517 Section 4.1.9. "typ" (Type) Header Parameter.

func (*Header) SetX509CertificateChain 

func (h *Header) SetX509CertificateChain(x5c []*x509.Certificate)

SetX509CertificateChain sets RFC 7515 Section 4.1.6. "x5c" (X.509 Certificate Chain) Header Parameter.

func (*Header) SetX509CertificateSHA1 

func (h *Header) SetX509CertificateSHA1(x5t []byte)

SetX509CertificateSHA1 sets RFC 7515 Section 4.1.7. "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter.

func (*Header) SetX509CertificateSHA256 

func (h *Header) SetX509CertificateSHA256(x5tS256 []byte)

SetX509CertificateSHA256 sets RFC 7517 Section 4.1.8. "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Header Parameter.

func (*Header) SetX509URL 

func (h *Header) SetX509URL(x5u *url.URL)

SetX509URL sets RFC 7515 Section 4.1.5. "x5u" (X.509 URL) Header Parameter.

func (*Header) Type 

func (h *Header) Type() string

Type is RFC 7517 Section 4.1.9. "typ" (Type) Header Parameter.

func (*Header) UnmarshalJSON 

func (h *Header) UnmarshalJSON(data []byte) error

func (*Header) X509CertificateChain 

func (h *Header) X509CertificateChain() []*x509.Certificate

X509CertificateChain is RFC 7515 Section 4.1.6. "x5c" (X.509 Certificate Chain) Header Parameter.

func (*Header) X509CertificateSHA1 

func (h *Header) X509CertificateSHA1() []byte

X509CertificateSHA1 is RFC 7515 Section 4.1.7. "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter.

func (*Header) X509CertificateSHA256 

func (h *Header) X509CertificateSHA256() []byte

X509CertificateSHA256 is RFC 7517 Section 4.1.8. "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Header Parameter.

func (*Header) X509URL 

func (h *Header) X509URL() *url.URL

X509URL is RFC 7515 Section 4.1.5. "x5u" (X.509 URL) Header Parameter.

type JWKKeyFinder added in v0.1.0 

type JWKKeyFinder struct {
	JWK *jwk.Key
}

JWKKeyFinder returns a specific signing key.

func (*JWKKeyFinder) FindKey added in v0.1.0 

func (f *JWKKeyFinder) FindKey(ctx context.Context, protected, unprotected *Header) (key sig.SigningKey, err error)

type KeyFinder 

type KeyFinder interface {
	FindKey(ctx context.Context, protected, unprotected *Header) (key sig.SigningKey, err error)
}

KeyFinder finds a signing key for the JWS message.

type Message 

type Message struct {
	Signatures []*Signature
	// contains filtered or unexported fields
}

Message is signed message.

func NewMessage 

func NewMessage(payload []byte) *Message

NewMessage returns a new Message that has no signature.

func NewRawMessage added in v0.0.5 

func NewRawMessage(payload []byte) *Message

NewRawMessage returns a new Message that has no signature.

func Parse 

func Parse(data []byte) (*Message, error)

Parse parses a Compact Serialized JWS Signature.

Example 
package main

import (
	"context"
	"fmt"
	"log"

	"github.com/shogo82148/goat/jwa"
	"github.com/shogo82148/goat/jwk"
	"github.com/shogo82148/goat/jws"
)

func main() {
	rawKey := `{"kty":"OKP","crv":"Ed25519",` +
		`"x":"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"}`
	key, err := jwk.ParseKey([]byte(rawKey))
	if err != nil {
		log.Fatal(err)
	}
	v := &jws.Verifier{
		AlgorithmVerifier: jws.AllowedAlgorithms{jwa.EdDSA},
		KeyFinder:         &jws.JWKKeyFinder{JWK: key},
	}

	raw := "eyJhbGciOiJFZERTQSJ9" +
		"." +
		"RXhhbXBsZSBvZiBFZDI1NTE5IHNpZ25pbmc" +
		"." +
		"hgyY0il_MGCjP0JzlnLWG1PPOt7-09PGcvMg3AIbQR6dWbhijcNR4ki4iylGjg5BhVsPt" +
		"9g7sVvpAr_MuM0KAg"

	msg, err := jws.Parse([]byte(raw))
	if err != nil {
		log.Fatal(err)
	}

	_, payload, err := v.Verify(context.Background(), msg)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(string(payload))
}

Output:

Example of Ed25519 signing

func (*Message) Compact 

func (msg *Message) Compact() ([]byte, error)

Compact encodes JWS Signature into Compact Serialization.

Example 
package main

import (
	"fmt"
	"log"

	"github.com/shogo82148/goat/jwa"
	"github.com/shogo82148/goat/jwk"
	"github.com/shogo82148/goat/jws"
)

func main() {
	rawKey := `{"kty":"OKP","crv":"Ed25519",` +
		`"d":"nWGxne_9WmC6hEr0kuwsxERJxWl7MmkZcDusAxyuf2A",` +
		`"x":"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"}`
	key, err := jwk.ParseKey([]byte(rawKey))
	if err != nil {
		log.Fatal(err)
	}
	header := jws.NewHeader()
	header.SetAlgorithm(jwa.EdDSA)
	msg := jws.NewMessage([]byte("Example of Ed25519 signing"))
	if err := msg.Sign(header, nil, jwa.EdDSA.New().NewSigningKey(key)); err != nil {
		log.Fatal(err)
	}

	data, err := msg.Compact()
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(string(data))
}

Output:

eyJhbGciOiJFZERTQSJ9.RXhhbXBsZSBvZiBFZDI1NTE5IHNpZ25pbmc.hgyY0il_MGCjP0JzlnLWG1PPOt7-09PGcvMg3AIbQR6dWbhijcNR4ki4iylGjg5BhVsPt9g7sVvpAr_MuM0KAg

func (*Message) MarshalJSON added in v0.0.5 

func (msg *Message) MarshalJSON() ([]byte, error)

func (*Message) Sign 

func (msg *Message) Sign(protected, header *Header, key sig.SigningKey) error

Sign adds a new signature signed by key.

func (*Message) UnmarshalJSON 

func (msg *Message) UnmarshalJSON(data []byte) error

UnmarshalJSON implements encoding/json.Unmarshaler. It parses data as JSON Serialized JWS.

type Signature 

type Signature struct {
	// contains filtered or unexported fields
}

Signature is a signature of Message.

type Verifier added in v0.1.0 

type Verifier struct {
	AlgorithmVerifier AlgorithmVerifier
	KeyFinder         KeyFinder
	// contains filtered or unexported fields
}

Verifier verifies the JWS message.

func (*Verifier) Verify added in v0.1.0 

func (v *Verifier) Verify(ctx context.Context, msg *Message) (protected *Header, payload []byte, err error)

Verify verifies the JWS message.

Example 
package main

import (
	"context"
	"fmt"
	"log"

	"github.com/shogo82148/goat/jwa"
	"github.com/shogo82148/goat/jwk"
	"github.com/shogo82148/goat/jws"
)

func main() {
	rawKey := `{"kty":"OKP","crv":"Ed25519",` +
		`"x":"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"}`
	key, err := jwk.ParseKey([]byte(rawKey))
	if err != nil {
		log.Fatal(err)
	}
	v := &jws.Verifier{
		AlgorithmVerifier: jws.AllowedAlgorithms{jwa.EdDSA},
		KeyFinder:         &jws.JWKKeyFinder{JWK: key},
	}

	raw := "eyJhbGciOiJFZERTQSJ9" +
		"." +
		"RXhhbXBsZSBvZiBFZDI1NTE5IHNpZ25pbmc" +
		"." +
		"hgyY0il_MGCjP0JzlnLWG1PPOt7-09PGcvMg3AIbQR6dWbhijcNR4ki4iylGjg5BhVsPt" +
		"9g7sVvpAr_MuM0KAg"

	msg, err := jws.Parse([]byte(raw))
	if err != nil {
		log.Fatal(err)
	}

	_, payload, err := v.Verify(context.Background(), msg)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(string(payload))
}

Output:

Example of Ed25519 signing

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.