Documentation
¶
Index ¶
- Variables
- type ECDSAPreset
- type ECDSASigner
- type ECDSAVerifier
- type ED25519Signer
- type ED25519Verifier
- type HMACPreset
- type HMACSigner
- type HMACVerifier
- type RSAPreset
- type RSASigner
- type RSAVerifier
- type SourcedECDSASigner
- type SourcedECDSAVerifier
- type SourcedED25519Signer
- type SourcedED25519Verifier
- type SourcedHMACSigner
- type SourcedHMACVerifier
- type SourcedRSASigner
- type SourcedRSAVerifier
Constants ¶
This section is empty.
Variables ¶
var ( // ES256 is ECDSA using the P-256 curve and SHA-256. ES256 = ECDSAPreset{ Hash: crypto.SHA256, Alg: jwa.ES256, Crv: elliptic.P256(), } // ES384 is ECDSA using the P-384 curve and SHA-384. ES384 = ECDSAPreset{ Hash: crypto.SHA384, Alg: jwa.ES384, Crv: elliptic.P384(), } // ES512 is ECDSA using the P-521 curve and SHA-512. ES512 = ECDSAPreset{ Hash: crypto.SHA512, Alg: jwa.ES512, Crv: elliptic.P521(), } )
var ( // HS256 is HMAC using SHA-256. HS256 = HMACPreset{ Hash: crypto.SHA256, Alg: jwa.HS256, } // HS384 is HMAC using SHA-384. HS384 = HMACPreset{ Hash: crypto.SHA384, Alg: jwa.HS384, } // HS512 is HMAC using SHA-512. HS512 = HMACPreset{ Hash: crypto.SHA512, Alg: jwa.HS512, } )
var ( // RS256 is RSASSA-PKCS1-v1_5 using SHA-256. RS256 = RSAPreset{Hash: crypto.SHA256, Alg: jwa.RS256} // RS384 is RSASSA-PKCS1-v1_5 using SHA-384. RS384 = RSAPreset{Hash: crypto.SHA384, Alg: jwa.RS384} // RS512 is RSASSA-PKCS1-v1_5 using SHA-512. RS512 = RSAPreset{Hash: crypto.SHA512, Alg: jwa.RS512} // PS256 is RSASSA-PSS using SHA-256 and MGF1 with SHA-256. PS256 = RSAPreset{Hash: crypto.SHA256, Alg: jwa.PS256} // PS384 is RSASSA-PSS using SHA-384 and MGF1 with SHA-384. PS384 = RSAPreset{Hash: crypto.SHA384, Alg: jwa.PS384} // PS512 is RSASSA-PSS using SHA-512 and MGF1 with SHA-512. PS512 = RSAPreset{Hash: crypto.SHA512, Alg: jwa.PS512} )
var ErrInvalidSignature = errors.New("invalid signature")
ErrInvalidSignature is returned by a verifier when a token's signature does not match its header and payload, or when the signature is malformed. A source-backed verifier also returns it once no candidate key accepts the token.
var ErrUnsupportedAlgorithm = errors.New("unsupported algorithm")
ErrUnsupportedAlgorithm is returned when a preset names an algorithm the plugin cannot map to a signing scheme — for example an RSA plugin given an algorithm that is neither RS* nor PS*.
Functions ¶
This section is empty.
Types ¶
type ECDSAPreset ¶
An ECDSAPreset bundles the curve, hash, and algorithm identifier for one ECDSA signing scheme. Pass one of the exported presets to the ECDSA constructors.
type ECDSASigner ¶
type ECDSASigner struct {
// contains filtered or unexported fields
}
An ECDSASigner signs tokens with ECDSA as a jwt.ProducerPlugin. Build one with NewECDSASigner.
func NewECDSASigner ¶
func NewECDSASigner(secretKey *ecdsa.PrivateKey, preset ECDSAPreset) *ECDSASigner
NewECDSASigner returns a jwt.ProducerPlugin that signs tokens with ECDSA, using the curve and hash carried by the preset (one of ES256, ES384, ES512).
See RFC 7518, section 3.4: https://datatracker.ietf.org/doc/html/rfc7518#section-3.4
type ECDSAVerifier ¶
type ECDSAVerifier struct {
// contains filtered or unexported fields
}
An ECDSAVerifier verifies ECDSA-signed tokens as a jwt.RecipientPlugin. Build one with NewECDSAVerifier. It returns ErrInvalidSignature when the signature does not match.
func NewECDSAVerifier ¶
func NewECDSAVerifier(publicKey *ecdsa.PublicKey, preset ECDSAPreset) *ECDSAVerifier
NewECDSAVerifier returns a jwt.RecipientPlugin that verifies ECDSA-signed tokens, using the curve and hash carried by the preset (one of ES256, ES384, ES512).
See RFC 7518, section 3.4: https://datatracker.ietf.org/doc/html/rfc7518#section-3.4
type ED25519Signer ¶
type ED25519Signer struct {
// contains filtered or unexported fields
}
An ED25519Signer signs tokens with the Ed25519 EdDSA scheme as a jwt.ProducerPlugin. Build one with NewED25519Signer.
func NewED25519Signer ¶
func NewED25519Signer(secretKey ed25519.PrivateKey) *ED25519Signer
NewED25519Signer returns a jwt.ProducerPlugin that signs tokens with Ed25519 (EdDSA).
See RFC 8032, section 3.3: https://datatracker.ietf.org/doc/html/rfc8032#section-3.3
type ED25519Verifier ¶
type ED25519Verifier struct {
// contains filtered or unexported fields
}
An ED25519Verifier verifies Ed25519-signed tokens as a jwt.RecipientPlugin. Build one with NewED25519Verifier. It returns ErrInvalidSignature when the signature does not match.
func NewED25519Verifier ¶
func NewED25519Verifier(publicKey ed25519.PublicKey) *ED25519Verifier
NewED25519Verifier returns a jwt.RecipientPlugin that verifies Ed25519-signed (EdDSA) tokens.
See RFC 8032, section 3.3: https://datatracker.ietf.org/doc/html/rfc8032#section-3.3
type HMACPreset ¶
An HMACPreset bundles the hash and algorithm identifier for one HMAC signing scheme. Pass one of the exported presets to the HMAC constructors.
type HMACSigner ¶
type HMACSigner struct {
// contains filtered or unexported fields
}
An HMACSigner signs tokens with HMAC-SHA-2 as a jwt.ProducerPlugin. The same secret is used to sign and to verify, so keep it private to the trusted parties. Build one with NewHMACSigner.
func NewHMACSigner ¶
func NewHMACSigner(secretKey []byte, preset HMACPreset) *HMACSigner
NewHMACSigner returns a jwt.ProducerPlugin that signs tokens with HMAC, using the hash carried by the preset (one of HS256, HS384, HS512).
See RFC 7518, section 3.2: https://datatracker.ietf.org/doc/html/rfc7518#section-3.2
type HMACVerifier ¶
type HMACVerifier struct {
// contains filtered or unexported fields
}
An HMACVerifier verifies HMAC-signed tokens as a jwt.RecipientPlugin. Build one with NewHMACVerifier. It returns ErrInvalidSignature when the signature does not match.
func NewHMACVerifier ¶
func NewHMACVerifier(secretKey []byte, preset HMACPreset) *HMACVerifier
NewHMACVerifier returns a jwt.RecipientPlugin that verifies HMAC-signed tokens, using the hash carried by the preset (one of HS256, HS384, HS512). The secret must match the one used to sign.
See RFC 7518, section 3.2: https://datatracker.ietf.org/doc/html/rfc7518#section-3.2
type RSAPreset ¶
An RSAPreset bundles the hash and algorithm identifier for one RSA signing scheme. Pass one of the exported presets to the RSA constructors: the RS* presets use RSASSA-PKCS1-v1_5, the PS* presets use RSASSA-PSS, and both run on the same RSA keys.
type RSASigner ¶
type RSASigner struct {
// contains filtered or unexported fields
}
An RSASigner signs tokens with RSA (RSASSA-PKCS1-v1_5 or RSASSA-PSS, per the preset) as a jwt.ProducerPlugin. Build one with NewRSASigner.
func NewRSASigner ¶
func NewRSASigner(secretKey *rsa.PrivateKey, preset RSAPreset) *RSASigner
NewRSASigner returns a jwt.ProducerPlugin that signs tokens with RSA, using the hash carried by the preset (one of RS256, RS384, RS512, PS256, PS384, PS512); the preset's algorithm selects PKCS1v15 (RS*) or PSS (PS*). The key must be at least 2048 bits.
See RFC 7518, sections 3.3 and 3.5: https://datatracker.ietf.org/doc/html/rfc7518#section-3.3
type RSAVerifier ¶
type RSAVerifier struct {
// contains filtered or unexported fields
}
An RSAVerifier verifies RSA-signed tokens (RSASSA-PKCS1-v1_5 or RSASSA-PSS, per the preset) as a jwt.RecipientPlugin. Build one with NewRSAVerifier. It returns ErrInvalidSignature when the signature does not match.
func NewRSAVerifier ¶
func NewRSAVerifier(publicKey *rsa.PublicKey, preset RSAPreset) *RSAVerifier
NewRSAVerifier returns a jwt.RecipientPlugin that verifies RSA-signed tokens, using the hash carried by the preset (one of RS256, RS384, RS512, PS256, PS384, PS512); the preset's algorithm selects PKCS1v15 (RS*) or PSS (PS*). It accepts only tokens whose alg matches the preset's, so an RS* verifier rejects a PS* token.
See RFC 7518, sections 3.3 and 3.5: https://datatracker.ietf.org/doc/html/rfc7518#section-3.3
type SourcedECDSASigner ¶
type SourcedECDSASigner struct {
// contains filtered or unexported fields
}
A SourcedECDSASigner signs like an ECDSASigner but resolves its key from a jwk.Source at each call, so the plugin follows key rotation. Build one with NewSourcedECDSASigner.
func NewSourcedECDSASigner ¶
func NewSourcedECDSASigner(source *jwk.Source, preset ECDSAPreset) *SourcedECDSASigner
NewSourcedECDSASigner returns a jwt.ProducerPlugin that signs tokens with ECDSA, drawing the key from the source for the header's KID. The preset (one of ES256, ES384, ES512) selects the curve and hash.
See RFC 7518, section 3.4: https://datatracker.ietf.org/doc/html/rfc7518#section-3.4
type SourcedECDSAVerifier ¶
type SourcedECDSAVerifier struct {
// contains filtered or unexported fields
}
A SourcedECDSAVerifier verifies like an ECDSAVerifier but resolves candidate keys from a jwk.Source at each call. When the token names a KID it tries only that key; otherwise it tries every key in the source. Build one with NewSourcedECDSAVerifier.
func NewSourcedECDSAVerifier ¶
func NewSourcedECDSAVerifier(source *jwk.Source, preset ECDSAPreset) *SourcedECDSAVerifier
NewSourcedECDSAVerifier returns a jwt.RecipientPlugin that verifies ECDSA-signed tokens against keys drawn from the source. The preset (one of ES256, ES384, ES512) selects the curve and hash.
See RFC 7518, section 3.4: https://datatracker.ietf.org/doc/html/rfc7518#section-3.4
type SourcedED25519Signer ¶
type SourcedED25519Signer struct {
// contains filtered or unexported fields
}
A SourcedED25519Signer signs like an ED25519Signer but resolves its key from a jwk.Source at each call, so the plugin follows key rotation. Build one with NewSourcedED25519Signer.
func NewSourcedED25519Signer ¶
func NewSourcedED25519Signer(source *jwk.Source) *SourcedED25519Signer
NewSourcedED25519Signer returns a jwt.ProducerPlugin that signs tokens with Ed25519 (EdDSA), drawing the key from the source for the header's KID.
See RFC 8032, section 3.3: https://datatracker.ietf.org/doc/html/rfc8032#section-3.3
type SourcedED25519Verifier ¶
type SourcedED25519Verifier struct {
// contains filtered or unexported fields
}
A SourcedED25519Verifier verifies like an ED25519Verifier but resolves candidate keys from a jwk.Source at each call. When the token names a KID it tries only that key; otherwise it tries every key in the source. Build one with NewSourcedED25519Verifier.
func NewSourcedED25519Verifier ¶
func NewSourcedED25519Verifier(source *jwk.Source) *SourcedED25519Verifier
NewSourcedED25519Verifier returns a jwt.RecipientPlugin that verifies Ed25519-signed (EdDSA) tokens against keys drawn from the source.
See RFC 8032, section 3.3: https://datatracker.ietf.org/doc/html/rfc8032#section-3.3
type SourcedHMACSigner ¶
type SourcedHMACSigner struct {
// contains filtered or unexported fields
}
A SourcedHMACSigner signs like an HMACSigner but resolves its secret from a jwk.Source at each call, so the plugin follows key rotation. Build one with NewSourcedHMACSigner.
func NewSourcedHMACSigner ¶
func NewSourcedHMACSigner(source *jwk.Source, preset HMACPreset) *SourcedHMACSigner
NewSourcedHMACSigner returns a jwt.ProducerPlugin that signs tokens with HMAC, drawing the secret from the source for the header's KID. The preset (one of HS256, HS384, HS512) selects the hash.
See RFC 7518, section 3.2: https://datatracker.ietf.org/doc/html/rfc7518#section-3.2
type SourcedHMACVerifier ¶
type SourcedHMACVerifier struct {
// contains filtered or unexported fields
}
A SourcedHMACVerifier verifies like an HMACVerifier but resolves candidate secrets from a jwk.Source at each call. When the token names a KID it tries only that secret; otherwise it tries every secret in the source. Build one with NewSourcedHMACVerifier.
func NewSourcedHMACVerifier ¶
func NewSourcedHMACVerifier(source *jwk.Source, preset HMACPreset) *SourcedHMACVerifier
NewSourcedHMACVerifier returns a jwt.RecipientPlugin that verifies HMAC-signed tokens against secrets drawn from the source. The preset (one of HS256, HS384, HS512) selects the hash.
See RFC 7518, section 3.2: https://datatracker.ietf.org/doc/html/rfc7518#section-3.2
type SourcedRSASigner ¶
type SourcedRSASigner struct {
// contains filtered or unexported fields
}
A SourcedRSASigner signs like an RSASigner but resolves its key from a jwk.Source at each call, so the plugin follows key rotation. Build one with NewSourcedRSASigner.
func NewSourcedRSASigner ¶
func NewSourcedRSASigner(source *jwk.Source, preset RSAPreset) *SourcedRSASigner
NewSourcedRSASigner returns a jwt.ProducerPlugin that signs tokens with RSA, drawing the key from the source for the header's KID. The preset (one of RS256, RS384, RS512, PS256, PS384, PS512) selects the hash and scheme, and the key must be at least 2048 bits.
See RFC 7518, sections 3.3 and 3.5: https://datatracker.ietf.org/doc/html/rfc7518#section-3.3
type SourcedRSAVerifier ¶
type SourcedRSAVerifier struct {
// contains filtered or unexported fields
}
A SourcedRSAVerifier verifies like an RSAVerifier but resolves candidate keys from a jwk.Source at each call. When the token names a KID it tries only that key; otherwise it tries every key in the source. Build one with NewSourcedRSAVerifier.
func NewSourcedRSAVerifier ¶
func NewSourcedRSAVerifier(source *jwk.Source, preset RSAPreset) *SourcedRSAVerifier
NewSourcedRSAVerifier returns a jwt.RecipientPlugin that verifies RSA-signed tokens against keys drawn from the source. The preset (one of RS256, RS384, RS512, PS256, PS384, PS512) selects the hash and scheme.
See RFC 7518, sections 3.3 and 3.5: https://datatracker.ietf.org/doc/html/rfc7518#section-3.3
Source Files