Struct TokenVerifier 

pub struct TokenVerifier { /* private fields */ }

How bearer tokens are checked.

A shared secret (HS256) lets the server issue tokens itself. A public key (RS256, ES256 or EdDSA) lets another service sign tokens, for example one per database, while the server holds no secret at all.

Implementations

impl TokenVerifier

pub fn shared_secret(secret: &str) -> Self

Verify HS256 tokens signed with secret.

pub fn with_policy(self, policy: TokenPolicy) -> Self

Enforce policy on every token.

pub fn public_key_text(text: &str) -> Result<Self, String>

Verify tokens with a public key given as PEM, or as base64 of the DER encoded SubjectPublicKeyInfo (what openssl pkey -pubout -outform DER writes), for keys passed inline through an environment variable.

pub fn public_key_pem(pem: &[u8]) -> Result<Self, String>

Verify tokens signed by the private half of a PEM public key. The algorithm follows the key: RSA keys use RS256, EC P-256 keys ES256, Ed25519 keys EdDSA.

pub fn with_issuer_audience( self, issuer: Option<String>, audience: Option<String>, ) -> Self

Also require these iss / aud values when set.

pub fn verify(&self, token: &str) -> Result<Claims, ApiError>

Validate a token and return its claims.

pub fn authenticate(&self, token: &str) -> Result<AuthenticatedAgent, ApiError>

Validate a token into the caller it represents, enforcing the policy.