Jwt

On this page

Shape
Example
Good to know
In JSON
Details

A signed token: three parts joined by ..

Use it for a token you receive. crypto.verify_jwt checks it and gives its JwtClaims. Don't read one without checking it.

Shape

One secret value, with no parts.

Example

example

var example: Jwt = Jwt("eyJhbGciOiJFZERTQSJ9.RXhhbXBsZSBvZiBFZDI1NTE5IHNpZ25pbmc.hgyY0il_MGCjP0JzlnLWG1PPOt7-09PGcvMg3AIbQR6dWbhijcNR4ki4iylGjg5BhVsPt9g7sVvpAr_MuM0KAg")assert example == example

In a real app it arrives from outside, such as in a request, rather than as text you write in your code.

text.parse(raw, as: Jwt) reads one from text that comes from outside. Text that isn't one at all fails malformed.

Good to know

It is a secret, so it is never sent, logged, stored or shown.
A token with no signature is refused.
== tells you whether two are the same. < and list.sort_by don't take it.

In JSON

A string when it arrives, and written redacted when it leaves, in a request, a response or json.write:

json

"<redacted Jwt>"

Details

Text form, storage, how it is shown, and operations

Jwt is in the group Security, and has been in Jadpo since 0.1.0.

Text form

text.parse reads one from its text as it is typed. text.from and text.format don't take it, so nothing writes it.

How it is stored

It is never stored.

How it is shown to people

text.format doesn't take it: a Jwt is never shown.

Operations

crypto.verify_jwt(token: Jwt, keys: List<Jwk>, issuer: Text?, audience: Text?, as: Type?) -> JwtClaims: The registered claims of token once it holds: signed by one of keys with that key's own algorithm (Ed25519, RS256 for an RSA key, ES256 for a P-256 key), never the one the token names, so none and every other algorithm fail invalid_signature; not expired, not used before its nbf and not issued later than now, against the clock with 30 seconds' leeway (expired, not_yet_valid); issued by issuer when one is given (wrong_issuer); and for audience, or for no audience when none is given (wrong_audience). A token that isn't one, or has no exp, is malformed. With as:, an object type of the application's, it gives instead the token's claims the type names, read as json.read reads it, a registered one as JwtClaims holds it, and fails mismatch when they aren't the type. It reads the clock, so it is called only in actions.

It also takes text.parse, json.read, json.write and ==. How every standard type behaves says how they work.

Markdown for agents: /docs/types/type-jwt.md.Built from Jadpo main at aee2e8f.