Struct JwtConfig 

pub struct JwtConfig {
    pub secret: Option<Zeroizing<String>>,
    pub public_key_pem: Option<Zeroizing<String>>,
    pub issuer: Option<String>,
    pub audience: Option<String>,
    pub require_audience: bool,
    pub jwks_url: Option<String>,
    pub subject_claim: Option<String>,
    pub algorithm: Option<String>,
    pub role_claim: Option<String>,
}

JWT validation configuration.

Security: The secret and public_key_pem fields are redacted in Debug output to prevent credential leakage in logs.

Fields

secret: Option<Zeroizing<String>>

HMAC secret for HS256/HS384/HS512 (base64-encoded or raw).

public_key_pem: Option<Zeroizing<String>>

Public key PEM for the asymmetric families.

RSA (RS*, PS*) and elliptic-curve (ES*) keys both live here: the family comes from algorithm, and mixing the two used to mean an EC key was parsed as RSA, failed, and left the validator with no key at all — which every token then failed against.

issuer: Option<String>

Expected issuer (iss claim).

audience: Option<String>

Expected audience (aud claim).

require_audience: bool

Whether to require audience validation. When true (default) and audience is None, validator construction fails. Set to false only if tokens legitimately carry no audience.

jwks_url: Option<String>

JWKS URL for fetching public keys (OIDC discovery).

subject_claim: Option<String>

Claim name for the principal identity (default: sub).

algorithm: Option<String>

Algorithm to use. Default: HS256.

role_claim: Option<String>

Claim name or dot-separated path for role extraction (default: roles). Examples: "roles", "realm_access.roles", "https://example.com/roles".

Trait Implementations

impl Clone for JwtConfig

fn clone(&self) -> JwtConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JwtConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for JwtConfig

fn default() -> JwtConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for JwtConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for JwtConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.