jti

Documentation

Overview

Package jti implements the JTI (JWT/token ID) allowlist that backs token revocation and session-bound replay detection.

Index

• type DenyList
  • func NewCacheDenyList(c *cache.Cache, name string) (DenyList, error)
• type Store
  • func NewCacheStore(c *cache.Cache) (Store, error)

Types

type DenyList

type DenyList interface {
	// Deny marks jti as unusable until ttl elapses.
	Deny(ctx context.Context, jti string, ttl time.Duration) error
	// Denied returns true when jti has been denied.
	Denied(ctx context.Context, jti string) (bool, error)
}

DenyList records JTIs that may no longer be used: revoked JWT access tokens (RFC 7009) and already-seen client_assertion JTIs (replay defence).

func NewCacheDenyList

func NewCacheDenyList(c *cache.Cache, name string) (DenyList, error)

NewCacheDenyList creates the default cache-backed DenyList under the given instance name.

type Store

type Store interface {
	// Issue registers jti as valid for sessionID with the given TTL.
	Issue(ctx context.Context, jti, sessionID string, ttl time.Duration) error
	// Rotate atomically replaces oldJTI with newJTI for sessionID. Return false (no error)
	// when oldJTI is absent or belongs to a different session.
	Rotate(ctx context.Context, oldJTI, newJTI, sessionID string, ttl time.Duration) (bool, error)
	// Revoke removes jti from the allowlist.
	Revoke(ctx context.Context, jti string) error
	// Validate returns true when jti exists in the allowlist and belongs to sessionID.
	Validate(ctx context.Context, jti, sessionID string) (bool, error)
}

Store manages the JTI allowlist.

func NewCacheStore

func NewCacheStore(c *cache.Cache) (Store, error)

NewCacheStore creates the default cache-backed JTI Store using the app's cache.