jwt

jwt

A library to handle JWT in Go. Limited to HMAC-SHA and Ed25519 only.

Usage

import "git.sr.ht/~gbrlsnchs/jwt"

var alg = jwt.NewHS256([]byte("secret"))

type Claims struct {
	jwt.RegisteredClaims
	Foo string `json:"foo"`
	Bar string `json:"bar"`
}

func sign(claims Claims) ([]byte, error) {
	token, err := jwt.Sign(claims, alg, nil)
	if err != nil {
		return nil, err
	}
	return token, nil
}

func verify(token []byte) (*Claims, error) {
	jot, err := jwt.Verify(token, alg, nil)
	if err != nil {
		return nil, err
	}
	return &jot.Claims, nil
}

Validating default claims

import (
	"time"

	"git.sr.ht/~gbrlsnchs/jwt"
)

var alg = jwt.NewHS256([]byte("secret"))

type Claims struct {
	jwt.RegisteredClaims
	Foo string `json:"foo"`
	Bar string `json:"bar"`
}

func sign(claims Claims) ([]byte, error) {
	token, err := jwt.Sign(claims, alg, nil)
	if err != nil {
		return nil, err
	}
	return token, nil
}

func verify(token []byte) (*Claims, error) {
	now := time.Now()

	var vd jwt.Validator
	opts := &jwt.VerifyOptions[Claims]{
		Validators: []jwt.ValidatorFunc{
			vd.ExpirationTime(now),
		},
	}
	jot, err := jwt.Verify(token, alg, opts)
	if err != nil {
		return nil, err
	}
	return &jot.Claims, nil
}

Replacing algorithm based on key ID

import (
	"time"

	"git.sr.ht/~gbrlsnchs/jwt"
)

var defaultAlg = jwt.NewHS256([]byte("secret_foo"))

var algs = map[string]jwt.Algorithm{
	"foo": defaultArg,
	"bar": jwt.NewHS256([]byte("secret_bar")),
}

type Claims struct {
	jwt.RegisteredClaims
	Foo string `json:"foo"`
	Bar string `json:"bar"`
}

func sign(claims Claims, keyID string) ([]byte, error) {
	opts := &jwt.SignOptions{
		KeyID: kid,
	}
	token, err := jwt.Sign(claims, algs[keyID], nil)
	if err != nil {
		return nil, err
	}
	return token, nil
}

func verify(token []byte) (*Claims, error) {
	now := time.Now()

	var vd jwt.Validator
	opts := &jwt.VerifyOptions[Claims]{
		ReplaceAlgorithm: func(jot *jwt.JWT[Claims]) jwt.Algorithm {
			return algs[jot.Header.KeyID]
		},
		Validators: []jwt.ValidatorFunc{
			vd.ExpirationTime(now),
		},
	}
	jot, err := jwt.Verify(token, defaultAlg, opts)
	if err != nil {
		return nil, err
	}
	return &jot.Claims, nil
}