alibi_plugins/jwt/
verification.rs

1use super::JwtAlgorithm;
2use super::JwtAudience;
3use super::JwtPlugin;
4use super::JwtVerifyPolicy;
5use super::claims::decode_compact_json;
6use super::claims::decode_compact_part;
7use super::claims::js_truthy;
8use super::claims::validate_critical_header;
9use super::crypto;
10use alibi_core::AuthContext;
11use alibi_core::AuthRequest;
12use alibi_core::AuthResult;
13use alibi_core::AuthSchema;
14use chrono::Utc;
15use serde_json::Map;
16use serde_json::Value;
17use std::str::FromStr;
18impl JwtPlugin {
19    /// Verify a token against the persisted keyring and configured claims.
20    /// Invalid signatures, malformed tokens and claim failures return `None`.
21    pub async fn verify_jwt(
22        &self,
23        token: &str,
24        issuer: Option<&str>,
25        request: Option<&AuthRequest>,
26        ctx: &AuthContext<impl AuthSchema>,
27    ) -> AuthResult<Option<Map<String, Value>>> {
28        let claims = self.config.claims.clone();
29        let issuer = issuer
30            .filter(|issuer| !issuer.is_empty())
31            .or(claims.issuer.as_deref())
32            .unwrap_or(&ctx.config.base_url);
33        let audience = claims
34            .audience
35            .unwrap_or_else(|| JwtAudience::One(ctx.config.base_url.clone()));
36        let policy = JwtVerifyPolicy {
37            issuer,
38            audience: &audience,
39            tolerance: 0,
40            require_nonempty_subject: true,
41        };
42        Ok(self
43            .verify_internal(token, &policy, request, ctx)
44            .await
45            .unwrap_or(None))
46    }
47
48    #[expect(
49        clippy::as_conversions,
50        clippy::cast_precision_loss,
51        reason = "JavaScript-compatible numbers deliberately retain IEEE754 rounding and guarded integer coercion at the wire or adapter boundary"
52    )]
53    pub(in crate::jwt) async fn verify_internal(
54        &self,
55        token: &str,
56        policy: &JwtVerifyPolicy<'_>,
57        request: Option<&AuthRequest>,
58        ctx: &AuthContext<impl AuthSchema>,
59    ) -> AuthResult<Option<Map<String, Value>>> {
60        let parts = token.split('.').collect::<Vec<_>>();
61        let [header, payload, signature] = parts.as_slice() else {
62            return Ok(None);
63        };
64        let header = decode_compact_json(header, false)?;
65        let Some(header_object) = header.as_object() else {
66            return Ok(None);
67        };
68        if validate_critical_header(header_object, false).is_err() {
69            return Ok(None);
70        }
71        let Some(kid) = header
72            .get("kid")
73            .and_then(Value::as_str)
74            .filter(|value| !value.is_empty())
75        else {
76            return Ok(None);
77        };
78        let Some(key) = self
79            .keys_at_path(request, "virtual:", ctx)
80            .await?
81            .into_iter()
82            .find(|key| key.id == kid)
83        else {
84            return Ok(None);
85        };
86        let algorithm = key
87            .alg
88            .as_deref()
89            .map(JwtAlgorithm::from_str)
90            .unwrap_or(Ok(self.config.key_pair.algorithm))?;
91        if header.get("alg").and_then(Value::as_str) != Some(algorithm.as_str()) {
92            return Ok(None);
93        }
94        let public: Value = serde_json::from_str(&key.public_key)?;
95        let input = format!("{}.{}", parts.first().copied().unwrap_or_default(), payload);
96        if !crypto::verify(
97            algorithm,
98            &public,
99            input.as_bytes(),
100            &decode_compact_part(signature, true)?,
101        )? {
102            return Ok(None);
103        }
104        let Some(payload) = decode_compact_json(payload, true)?.as_object().cloned() else {
105            return Ok(None);
106        };
107        let now = Utc::now().timestamp();
108        for field in ["iat", "exp", "nbf"] {
109            if payload.get(field).is_some_and(|value| !value.is_number()) {
110                return Ok(None);
111            }
112        }
113        if payload
114            .get("exp")
115            .and_then(Value::as_f64)
116            .is_some_and(|exp| exp <= (now - policy.tolerance) as f64)
117            || payload
118                .get("nbf")
119                .and_then(Value::as_f64)
120                .is_some_and(|nbf| nbf > (now + policy.tolerance) as f64)
121            || payload.get("iss").and_then(Value::as_str) != Some(policy.issuer)
122            || !payload
123                .get("aud")
124                .is_some_and(|value| policy.audience.matches(value))
125            || payload.get("aud").is_none_or(|value| !js_truthy(value))
126            || (policy.require_nonempty_subject
127                && payload.get("sub").is_none_or(|value| !js_truthy(value)))
128        {
129            return Ok(None);
130        }
131        Ok(Some(payload))
132    }
133}
alibi_plugins/jwt/verification.rs

alibi_plugins/jwt/
verification.rs
