Crate min_jwt[−][src]

Expand description

Minimal JWT

JSON Web Tokens are a method for representing claims between two parties.

They are used in authentication flows with a third party provider (e.g. Sign in with…) amongst other scenarios.

This crate provides functionality to sign and verify the signatures of JWTs.

Cryptography Features/Dependencies

This crate depends on other crates for all cryptographic operations. Find a supported crypto crate below which supports the algorithms required.

Dependent Crate(s)	Algorithm(s) Supported	Feature(s)
p256	ES256	p256
ring	ES256, HS256, RS256	ring
rsa, sha2	RS256	rsa, sha2

For instance, if you need ES256 support, you may choose to use the p256 crate and/or the ring crate. Suppose you chose the p256 crate. In your crate, depend on this crate and the relevant dependent crate in your Cargo.toml:

[dependencies]
min_jwt = { version = "0.2.0", features = [ "p256", "serde", "serde_json"] }
p256 = { version = "0.10.0", features = [ "ecdsa", "jwk", "pem"] }

Be sure to enable the relevant features as well.

When choosing a cryptography implementation, you may want to consider compatibility with your environment, the ability to import the signing and verifying keys in the given formats, and the security properties of the code (e.g. an audited implementation, resistence to timing attacks, etc.).

Usage

The encode_and_sign and verify functions are the primary functions for this crate.

To use the functions, construct the cryptography crate’s key. The cryptography crate may provide methods to import a key in PKCS8 PEM, PKCS8 DER, JSON Web Key (JWK), and other formats.

Then, use the key as either a sign::Signer or verify::Verifier parameter. The key may need to be wrapped in a provided type. See the sign or verify modules for more documentation and examples.

Examples

Sign using ES256 with `p256` crate

let jwk = r#"
{
    "kty": "EC",
    "crv": "P-256",
    "x": "erEk-zqoG1oYBLD3ohuz0tzIlU7XzFG1098HcCOu0Ck",
    "y": "lQLKfGS2F6mA97bOvo9AlfyNsn88Mf6Iwa5vmf6UkJw",
    "d": "8UmkmK0KO64KCDRZb4RCAHRZ0AfRWBn3Pv6hTv1VR9k"
}
"#;

let secret_key = ::p256::SecretKey::from_jwk_str(jwk).unwrap();
let signing_key = ::p256::ecdsa::SigningKey::from(secret_key);

let jwt = min_jwt::encode_and_sign(header, claims, &signing_key)?;

Verify using RS256 with `rsa` and `sha2` crates

use ::rsa::pkcs8::FromPublicKey;

let public_key =
"-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyfEiSb2ElqylyAfWkbV0
JmKwzaYH2JtWi05dELrGpSI+OM2mNmFnpxZVUUx77GWASD+u/EbDpB7TxoL8wW6r
SFuduTIb63uhqeilkj6VhpPXVLpZg6m8korAXPGaN5BBMTyBAbpWk9e72z5gOGaF
GI4xOv0v3N0MX2h9uXJvhPTpOdKn6jXEflUFF89OWGEh/3JnyZbX5p8+F8BAuseb
8gfpqT2Ct6KT5GrNiA7dPwjN7XFvVnvyYgR7+QXTVNRMrcrEUoJbR4DG+QVeyIRh
0JGqXtm901cviPBRbicIMn2f8qfs15XMSeHWrgel21Cv1wQh3I4xy+soZuZZ2i/p
zwIDAQAB
-----END PUBLIC KEY-----";

let public_key = ::rsa::RsaPublicKey::from_public_key_pem(public_key).unwrap();

let verifier = min_jwt::verify::rsa::RsaPublicKeyVerifier::with_rs256(public_key);
let result = min_jwt::verify(jwt, &verifier)?;

let header = result.decode_header();
let claims = result.decode_claims();