token

README

copied (and slightly modified) from https://github.com/futurenda/google-auth-id-token-verifier

Documentation

Index

• Variables
• type Certs
• type ClaimSet
  • func Decode(token string) (*ClaimSet, error)
  • func VerifyIDToken(idToken string, audience []string) (*ClaimSet, error)
  • func VerifySignedJWTWithCerts(token string, certs *Certs, allowedAuds []string, issuers []string, ...) (*ClaimSet, error)

Variables

var (
	ErrInvalidToken = errors.New("Invalid token")

	ErrPublicKeyNotFound = errors.New("No public key found for given kid")

	ErrWrongSignature = errors.New("Wrong token signature")

	ErrNoIssueTimeInToken = errors.New("No issue time in token")

	ErrNoExpirationTimeInToken = errors.New("No expiration time in token")

	ErrExpirationTimeTooFarInFuture = errors.New("Expiration time too far in future")

	ErrTokenUsedTooEarly = errors.New("Token used too early")

	ErrTokenUsedTooLate = errors.New("Token used too late")
)

var (
	// MaxTokenLifetime is one day
	MaxTokenLifetime = time.Second * 86400

	// ClockSkew - five minutes
	ClockSkew = time.Minute * 5

	// Issuers is the allowed oauth token issuers
	Issuers = []string{
		"accounts.google.com",
		"https://accounts.google.com",
	}
)

Types

type Certs

type Certs struct {
	Keys   map[string]*rsa.PublicKey
	Expiry time.Time
}

type ClaimSet

type ClaimSet struct {
	jws.ClaimSet
	Email         string `json:"email"`
	EmailVerified bool   `json:"email_verified"`
	Name          string `json:"name"`
	Picture       string `json:"picture"`
	GivenName     string `json:"given_name"`
	FamilyName    string `json:"family_name"`
	Locale        string `json:"locale"`
}

func Decode

func Decode(token string) (*ClaimSet, error)

Decode returns ClaimSet

func VerifyIDToken

func VerifyIDToken(idToken string, audience []string) (*ClaimSet, error)

func VerifySignedJWTWithCerts

func VerifySignedJWTWithCerts(
	token string,
	certs *Certs,
	allowedAuds []string,
	issuers []string,
	maxExpiry time.Duration) (*ClaimSet, error)

VerifySignedJWTWithCerts is golang port of OAuth2Client.prototype.verifySignedJwtWithCerts