Struct SecureJwtConfig 

pub struct SecureJwtConfig {

    pub allowed_algorithms: Vec<Algorithm>,
    pub required_issuers: HashSet<String>,
    pub required_audiences: HashSet<String>,
    pub max_token_lifetime: Duration,
    pub clock_skew: Duration,
    pub require_jti: bool,
    pub validate_nbf: bool,
    pub allowed_token_types: HashSet<String>,
    pub require_secure_transport: bool,
    pub jwt_secret: String,
    pub rsa_public_key_pem: Option<String>,
    pub ec_public_key_pem: Option<String>,
    pub ed_public_key_pem: Option<String>,
}

Fields

allowed_algorithms: Vec<Algorithm>

required_issuers: HashSet<String>

required_audiences: HashSet<String>

max_token_lifetime: Duration

clock_skew: Duration

require_jti: bool

validate_nbf: bool

allowed_token_types: HashSet<String>

require_secure_transport: bool

jwt_secret: String

HMAC secret for HS256/HS384/HS512

rsa_public_key_pem: Option<String>

PEM-encoded RSA public key for RS256/RS384/RS512/PS256/PS384/PS512

ec_public_key_pem: Option<String>

PEM-encoded EC public key for ES256/ES384

ed_public_key_pem: Option<String>

PEM-encoded Ed25519 public key for EdDSA

Implementations

impl SecureJwtConfig

Validates JWT tokens with configurable algorithm support and in-memory revocation.

Revocation Architecture

SecureJwtValidator maintains an in-memory revocation list (HashMap<JTI, SystemTime>) protected by a Mutex. This list is lost on process restart and is intended as a supplementary fast-path cache — not as a durable revocation store.

For production deployments, durable revocation should be handled by the storage-backed layer in the API module (see src/api/auth.rs), which persists revoked JTIs in the configured KV / database backend.

To bridge both layers, callers can register an optional on_revoke callback via SecureJwtValidator::set_on_revoke. When set, every call to [revoke_token] will first insert into the in-memory map and then invoke the callback with the JTI string, allowing the caller to persist the revocation to external storage without changing the existing API surface.

Size Limits

[cleanup_revoked_tokens] enforces a hard cap of 10 000 entries and time-based eviction to prevent unbounded memory growth.

pub fn builder() -> SecureJwtConfigBuilder

Create a new builder with secure default configurations.

Trait Implementations

impl Clone for SecureJwtConfig

fn clone(&self) -> SecureJwtConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecureJwtConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecureJwtConfig

fn default() -> Self

Returns the “default value” for a type.