alibi_plugins/jwt/
verification.rs

1use super::JwtAlgorithm;
2use super::JwtAudience;
3use super::JwtPlugin;
4use super::JwtVerifyPolicy;
5use super::claims::decode_compact_json;
6use super::claims::decode_compact_part;
7use super::claims::js_truthy;
8use super::claims::validate_critical_header;
9use super::crypto;
10use alibi_core::AuthContext;
11use alibi_core::AuthRequest;
12use alibi_core::AuthResult;
13use alibi_core::AuthSchema;
14use chrono::Utc;
15use serde_json::Map;
16use serde_json::Value;
17use std::str::FromStr;
18impl JwtPlugin {
19    /// Verify a token against the persisted keyring and configured claims.
20    /// Invalid signatures, malformed tokens and claim failures return `None`.
21    pub async fn verify_jwt(
22        &self,
23        token: &str,
24        issuer: Option<&str>,
25        request: Option<&AuthRequest>,
26        ctx: &AuthContext<impl AuthSchema>,
27    ) -> AuthResult<Option<Map<String, Value>>> {
28        let claims = self.config.claims.clone();
29        let issuer = issuer
30            .filter(|issuer| !issuer.is_empty())
31            .or(claims.issuer.as_deref())
32            .unwrap_or(&ctx.config.base_url);
33        let audience = claims
34            .audience
35            .unwrap_or_else(|| JwtAudience::One(ctx.config.base_url.clone()));
36        let policy = JwtVerifyPolicy {
37            issuer,
38            audience: &audience,
39            tolerance: 0,
40            require_nonempty_subject: true,
41        };
42        Ok(self
43            .verify_internal(token, &policy, request, ctx)
44            .await
45            .unwrap_or(None))
46    }
47
48    #[expect(
49        clippy::as_conversions,
50        clippy::cast_precision_loss,
51        reason = "JavaScript-compatible numbers deliberately retain IEEE754 rounding and guarded integer coercion at the wire or adapter boundary"
52    )]
53    pub(in crate::jwt) async fn verify_internal(
54        &self,
55        token: &str,
56        policy: &JwtVerifyPolicy<'_>,
57        request: Option<&AuthRequest>,
58        ctx: &AuthContext<impl AuthSchema>,
59    ) -> AuthResult<Option<Map<String, Value>>> {
60        let Some(payload) = self.verify_signed_payload(token, request, ctx).await? else {
61            return Ok(None);
62        };
63        let now = Utc::now().timestamp();
64        for field in ["iat", "exp", "nbf"] {
65            if payload.get(field).is_some_and(|value| !value.is_number()) {
66                return Ok(None);
67            }
68        }
69        if payload
70            .get("exp")
71            .and_then(Value::as_f64)
72            .is_some_and(|exp| exp <= (now - policy.tolerance) as f64)
73            || payload
74                .get("nbf")
75                .and_then(Value::as_f64)
76                .is_some_and(|nbf| nbf > (now + policy.tolerance) as f64)
77            || payload.get("iss").and_then(Value::as_str) != Some(policy.issuer)
78            || !payload
79                .get("aud")
80                .is_some_and(|value| policy.audience.matches(value))
81            || payload.get("aud").is_none_or(|value| !js_truthy(value))
82            || (policy.require_nonempty_subject
83                && payload.get("sub").is_none_or(|value| !js_truthy(value)))
84        {
85            return Ok(None);
86        }
87        Ok(Some(payload))
88    }
89    /// Verify the compact signature without enforcing JWT claim lifetime.
90    /// Logout hints deliberately accept expired ID tokens and apply their own claims.
91    pub(crate) async fn verify_signed_payload(
92        &self,
93        token: &str,
94        request: Option<&AuthRequest>,
95        ctx: &AuthContext<impl AuthSchema>,
96    ) -> AuthResult<Option<Map<String, Value>>> {
97        let parts = token.split('.').collect::<Vec<_>>();
98        let [header, payload, signature] = parts.as_slice() else {
99            return Ok(None);
100        };
101        let header = decode_compact_json(header, false)?;
102        let Some(header_object) = header.as_object() else {
103            return Ok(None);
104        };
105        if validate_critical_header(header_object, false).is_err() {
106            return Ok(None);
107        }
108        let Some(kid) = header
109            .get("kid")
110            .and_then(Value::as_str)
111            .filter(|value| !value.is_empty())
112        else {
113            return Ok(None);
114        };
115        let Some(key) = self
116            .keys_at_path(request, "virtual:", ctx)
117            .await?
118            .into_iter()
119            .find(|key| key.id == kid)
120        else {
121            return Ok(None);
122        };
123        let algorithm = key
124            .alg
125            .as_deref()
126            .map(JwtAlgorithm::from_str)
127            .unwrap_or(Ok(self.config.key_pair.algorithm))?;
128        if header.get("alg").and_then(Value::as_str) != Some(algorithm.as_str()) {
129            return Ok(None);
130        }
131        let public: Value = serde_json::from_str(&key.public_key)?;
132        let input = format!("{}.{}", parts.first().copied().unwrap_or_default(), payload);
133        if !crypto::verify(
134            algorithm,
135            &public,
136            input.as_bytes(),
137            &decode_compact_part(signature, true)?,
138        )? {
139            return Ok(None);
140        }
141        let Some(payload) = decode_compact_json(payload, true)?.as_object().cloned() else {
142            return Ok(None);
143        };
144        Ok(Some(payload))
145    }
146}
alibi_plugins/jwt/verification.rs

alibi_plugins/jwt/
verification.rs
