jwkset

README

go-jwkset

go-jwkset is a library to fetch JSON Web Key ("JWK") Set on top of go-jose/go-jose/v3 library. go-jwkset allows you to build a cache-ware custom fetcher for JWKSet.

Built-in fetcher implementation

• Plain HTTP
• AWS S3
• AWS Application Load Balancer

Versioning

This library follows Semantic Versions.

Documentation

Index

• func Decode(r io.Reader) ([]jose.JSONWebKey, error)
• func DecodeSigPublicKey(data []byte, kid string, algo jose.SignatureAlgorithm) ([]jose.JSONWebKey, error)
• type ALBFetcher
  • func (f *ALBFetcher) FetchJWKs(kid string) (*Response, error)
• type Cacher
  • func NewCacher(defaultExpiration, cleanupInterval time.Duration, f Fetcher) *Cacher
  • func (c *Cacher) FetchJWKs(cacheKey string) (*Response, error)
• type Fetcher
• type HTTPFetcher
  • func (f *HTTPFetcher) FetchJWKs(uri string) (*Response, error)
• type InMemoryFetcher
  • func (f *InMemoryFetcher) FetchJWKs(_ string) (*Response, error)
• type Response
• type S3Fetcher
  • func (f *S3Fetcher) FetchJWKs(path string) (*Response, error)

Functions

func Decode

func Decode(r io.Reader) ([]jose.JSONWebKey, error)

Decode decodes the data with reading from r into JWKs.

func DecodeSigPublicKey

func DecodeSigPublicKey(data []byte, kid string, algo jose.SignatureAlgorithm) ([]jose.JSONWebKey, error)

DecodeSigPublicKey decodes the plain public key into JWKs used for sigining. https://github.com/square/go-jose/blob/v2.4.1/jose-util/utils.go#L42

Types

type ALBFetcher

type ALBFetcher struct {
	Client *http.Client
	Region string
	Algo   jose.SignatureAlgorithm
}

ALBFetcher fetchs a public key from AWS's Application Load Balancer and decodes it into JWK.

func (*ALBFetcher) FetchJWKs

func (f *ALBFetcher) FetchJWKs(kid string) (*Response, error)

type Cacher

type Cacher struct {
	// contains filtered or unexported fields
}

Cacher fetches JWKs via Cache if available.

func NewCacher

func NewCacher(defaultExpiration, cleanupInterval time.Duration, f Fetcher) *Cacher

NewCacher returns Cacher with initializing cache store.

func (*Cacher) FetchJWKs

func (c *Cacher) FetchJWKs(cacheKey string) (*Response, error)

FetchJWKs tries to retrieve JWKs from Cache. If the cache is not available, it will call Fetcher.FetchJWKs and cache the result for future request.

type Fetcher

type Fetcher interface {
	// FetchJWKs retrieves JWKSet from path.
	FetchJWKs(path string) (*Response, error)
}

Fetcher is an interface that represents JWKs fetcher.

type HTTPFetcher

type HTTPFetcher struct {
	Client *http.Client
}

HTTPFetcher fetches JWKs over HTTP.

func (*HTTPFetcher) FetchJWKs

func (f *HTTPFetcher) FetchJWKs(uri string) (*Response, error)

FetchJWKs implements Fetcher interface by using http.Client. FetchJWKs tries to retrieve JWKSet from uri.

type InMemoryFetcher

type InMemoryFetcher struct {
	RAWJWKs []byte
}

InMemoryFetcher fetches JWKs from its memory.

func (*InMemoryFetcher) FetchJWKs

func (f *InMemoryFetcher) FetchJWKs(_ string) (*Response, error)

FetchJWKs implements Fetcher interface by using internal JWKs.

type Response

type Response struct {
	Keys []jose.JSONWebKey

	TTL time.Duration // This would be used as TTL for caching.
}

Response represents a response of JWK Set. This contains a TTL (Time to Live) for caching purpose.

type S3Fetcher

type S3Fetcher struct {
	S3Svc s3iface.S3API
}

S3Fetcher fetches JWKs via S3.

func (*S3Fetcher) FetchJWKs

func (f *S3Fetcher) FetchJWKs(path string) (*Response, error)

FetchJWKs implements JWKsS3Fetcher by using S3. It tries to retrieve an S3 object from path. path must be in s3://<bucket>/<key>.