Enum VerifyError 

#[non_exhaustive]
pub enum VerifyError {
    MalformedToken,
    AlgorithmNotAllowed,
    UnknownKey,
    InvalidKey,
    SignatureInvalid,
    IssuerMismatch,
    AudienceMismatch,
    AuthorizedPartyMismatch,
    AuthorizedPartyMissing,
    Expired,
    ImmatureToken,
    NonceMismatch,
    JwksUnavailable,
    InvalidToken,
}

Re-exported from axum_security_oidc: the standard ID-token claim set and the ID-token verification error (OidcContext::warm_jwks returns it). A failure while verifying an ID token.

Every variant is a rejection reason — the token is not trusted. The distinctions exist for diagnostics/logging; a caller should treat all of them as “authentication failed”.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

MalformedToken

The JWT could not be parsed (bad header, wrong number of segments, non-base64url payload).

AlgorithmNotAllowed

The token’s alg header is not in the verifier’s allow-list. Guards against algorithm-confusion / key-substitution attacks.

UnknownKey

No key in the JWKS matches the token’s kid (or the token carried no kid and the JWKS does not hold exactly one key).

InvalidKey

The matched JWK could not be turned into a verification key.

SignatureInvalid

The signature did not verify against the selected key.

IssuerMismatch

The iss claim did not match the expected issuer.

AudienceMismatch

The aud claim did not contain the expected audience (the client id).

AuthorizedPartyMismatch

The azp (authorized party) claim was present but did not equal the expected audience (the client id). Per OpenID Connect Core §3.1.3.7, a token minted for a different authorized party must not be accepted even if it lists this client in aud.

AuthorizedPartyMissing

The token named more than one audience but carried no azp claim. Per OpenID Connect Core §3.1.3.7 a multi-audience token must identify its authorized party, so it cannot be attributed to this client.

Expired

The exp claim is in the past (outside the configured leeway).

ImmatureToken

The nbf claim is in the future (outside the configured leeway).

NonceMismatch

The nonce claim did not match the expected value — replay protection.

JwksUnavailable

The signing keys could not be fetched from the provider’s jwks_uri (network error, non-2xx status, or unparsable JWK set), so the token could not be checked.

InvalidToken

A standard-claim check failed for a reason not covered above.

Trait Implementations

impl Debug for VerifyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Display for VerifyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Error for VerifyError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.