webjwt

Documentation

Overview

Package webjwt is the ONE verifier for platform-signed inbound-webhook bearer tokens (Bot Framework, Google Chat): RS256 against a published JWKS, with issuer/audience/expiry enforced and the key set cached — an unknown kid triggers a refetch at most once per interval, so key rotation works but a forged-kid flood is not amplified into JWKS hammering. Two adapters verifying JWTs two different ways is how drift bugs happen; both use this.

The golang-jwt SDK lives ONLY here (guarded by TestVendorSDKsOnlyInTheirAdapters).

Index

• type Verifier
  • func (v *Verifier) Verify(ctx context.Context, raw string) error

Types

type Verifier

type Verifier struct {
	MetadataURL string // OpenID configuration carrying jwks_uri; used when JWKSURL is empty
	JWKSURL     string // direct JWKS endpoint; takes precedence
	Issuer      string // required — an empty issuer never verifies
	Audience    string // required — an empty audience never verifies
	Client      *http.Client
	// contains filtered or unexported fields
}

Verifier validates RS256 bearer tokens against one platform's JWKS. Set either JWKSURL directly (Google's certs endpoint) or MetadataURL (an OpenID configuration document whose jwks_uri is followed — Bot Framework). Fields are read on each Verify, so tests may point them at a fake server after construction and before first use.

func (*Verifier) Verify

func (v *Verifier) Verify(ctx context.Context, raw string) error

Verify checks a raw compact JWT. It fails closed: missing configuration, unknown alg, unknown kid after one refresh, wrong issuer/audience, or an expired (or unexpiring) token are all errors.