bend-kit-jwt

Releases (14)

• 0.11.0.1 indexed
• 0.11.0.0 unindexed
• 0.10.0.0 unindexed
• 0.9.0.0 unindexed
• 0.8.0.0 unindexed
• 0.7.1.0 unindexed
• 0.7.0.0 unindexed
• 0.6.0.0 unindexed
• 0.5.0.0 unindexed
• 0.4.0.0 unindexed
• 0.3.0.1 unindexed
• 0.3.0.0 unindexed
• 0.2.0.0 unindexed
• 0.1.0.0 unindexed

Definitions (122)

jwt.bend

• type Alg
• type KeyHmac: the shared secret, at least the digest's size (RFC 7518 §3.2).
• type Err
• type PolicyWhat verify accepts: the one alg, the issuer and audience when Some, and leeway seconds of clock skew.
• def policy
• def iss
• def aud
• def leeway
• def policy.alg
• def alg.name
• def b64u.push
• def b64u.go
• def b64u
• def unb64u.cThe standard alphabet's char for c.
• def unb64u.padPadding for n mod 4 chars; 1 is never a whole group, so it gets a NUL.
• def unb64u.go
• def unb64u.same
• def unb64u.canon
• def unb64uStrict: only the URL-safe alphabet, no '=', and only the canonical text of its octets, so pad bits are 0.
• type LitA NumericDate (RFC 7519 §2) rounded up to whole seconds and capped at the U32 top, or None when it is negative or has an exponent.
• type FieldOne member: its name as octets, and what the checks need of its value.
• def secs.digit
• def secs.up
• def secs.goThe JSON parser has checked the grammar, so only digits and one '.' need telling apart.
• def secs
• def str.of
• def strs.push
• def strs
• def lit
• def fieldsAn object's members, names as octets, last first.
• def field
• def has
• def str
• type PartsA compact JWS: the header and claim members, the claims, the signing input, and the signature.
• def parse.jsonRFC 7515 §5.2 allows rejecting repeated names; a second "alg" is how parsers come to disagree.
• def parse.claims
• def parse.segs
• def parse.split
• def parseThree strict base64url segments, the first two JSON objects with no repeated names.
• def fail.if
• def head.alg
• def head.checkThe header's alg is exactly the pinned one, and it asks for no extension: crit (RFC 7515 §4.1.11) and b64 (RFC 7797) change how the token must be read, and neither is implemented.
• def when
• def text
• def audsRFC 7519 §4.1.3: aud is one string or an array of them.
• def lateexp (RFC 7519 §4.1.4): now must be before it; late by at least leeway fails.
• def earlynbf and iat: at most leeway seconds in the future.
• def octets
• def iss.bad
• def aud.has
• def aud.badRFC 7519 §4.1.3: a token with an aud that does not name us fails, as does one without aud when we want one.
• def claims.checkThe registered claims of c at unix time now.
• def inspect.parts
• def inspectThe header and claims of token, without its signature: the pure half of verify.
• def crypto.bytes
• def crypto.ok
• def mac.if
• def mac
• def mac.cmp
• def mac.checkThe MAC compares in constant time.
• def rsa.pem
• def rsa.jwk
• def ec.pem
• def ec.jwk
• def sig.checkDoes sig sign input under key for alg?
• def rsa.sign
• def ec.sign
• def sig.makeThe signature of input under key for alg.
• def header.kid
• def header{"alg":..,"typ":"JWT"}, then "kid" when given.
• def signing.inputheader.body in base64url, body being the compact JSON claims: the text the signature covers.
• def sign.done
• def sign.objverify accepts only an object with no repeated names, so sign makes no other kind.
• def sign.if
• def sign.body
• def signA compact token of claims signed with key for a; kid names the key in the header.
• def claims.done
• def check.sig
• def check.done
• def check.pinned
• def checkThe pinned alg, then the signature, then the claims.
• def verify.parsed
• def verifyThe claims of token when it is signed by key under p's alg and its claims hold at unix time now.
• type JwkA usable public key from a set: its kid, RSA or EC P-256, its alg ("" when the set gives none), and its two base64url parts (n and e, or x and y).
• def jwk.two
• def jwk.algAn alg member that is not a string can match no pinned alg.
• def jwk.use
• def jwk.kty
• def jwk.fields
• def jwk.obj
• def jwk.ofA key whose members repeat a name, at any depth, is skipped.
• def jwk.push
• def jwks.go
• def jwks.arr
• def jwks.doc
• def jwks.parseThe signing keys of a JWK Set document; members it cannot use (enc keys, other curves, oct) are skipped.
• def fam
• def jwk.fits
• def jwk.pickThe first key named kid that can check alg a.
• def jwk.key.of