Treatment verify

crypto/token/jwt::verify

Parameters

↳ var algorithm: string
↳ var audience: string = ""
↳ var issuer: string = ""
↳ var leeway: u64 = 60
↳ var prefix: string = ""
↳ var public_key: string = ""
↳ var secret: Option<Secret<string>> = _

Inputs

⇥ token: Block<Option<Secret<string>>>

Outputs

↦ claims: Block<string>
↦ error: Block<string>
↦ failed: Block<void>
↦ invalid: Block<void>
↦ reason: Block<string>
↦ valid: Block<void>

Verifies a received JSON Web Token.

token, after prefix when given (such as Bearer for the authorization secret of @HttpRequest), is checked for algorithm, which the token header must name:

• HS256, HS384 and HS512 against secret, the key shared with the issuer;
• RS256, RS384, RS512, ES256, ES384 and EdDSA against public_key, a PEM public key (-----BEGIN PUBLIC KEY-----).

A token naming another algorithm is invalid, so a public key is never taken as a shared secret. Its exp and nbf claims, when given, must hold with a tolerance of leeway seconds, and its iss and aud claims must be issuer and include audience, when those are not empty. The token and secret are revealed only to be checked.

If the token is valid, claims gives its claims as JSON, then valid is emitted. Otherwise reason tells why, then invalid is emitted, including when token is none or is not a Secret<string>. If algorithm is not valid, the key it needs is not given or not valid, or a secret cannot be revealed, failed is emitted and error contains the reason.