1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
[]
= "postrust-auth"
= true
= true
= true
= true
= true
= true
= "JWT authentication and role resolution for Postrust"
= true
= "README.md"
= ["jwt", "authentication", "postgres", "rls", "auth"]
[]
= true
= true
# `futures::lock::Mutex`: one JWKS fetch at a time, awaited by the requests
# that need its outcome, with no runtime behind it -- the same on a Worker as
# on tokio. Already in every host's tree.
= true
= true
= true
= true
= true
= true
= true
# jsonwebtoken 9 natively, verifying with ring -- which sqlx's TLS already
# links into the server, so it costs nothing.
[]
= true
# Only for the `jwt-rust-crypto` feature below.
= { = "jsonwebtoken", = "10.4", = false, = [
"rust_crypto",
], = true }
[]
# On wasm32 (a Cloudflare Worker) ring needs a C cross toolchain, so the
# verifying is done by jsonwebtoken 10's pure-Rust RustCrypto backend instead.
# Renamed, and aliased back to `jsonwebtoken` in lib.rs: the API this crate
# uses is the same in both. Not used natively, where the RustCrypto backend
# would cost the server binary 0.7 MB and aws-lc-rs 2.6 MB. No `use_pem`:
# asymmetric keys come from a JWK, and `DecodingKey::from_*_components` builds
# them without PEM (true of jsonwebtoken 9 too). `rust_crypto` already pulled
# in rsa, p256, p384 and ed25519-dalek, and the library's verifier dispatches
# on the token's algorithm at run time, so they were linked into the Worker
# even when only HMAC was accepted. Accepting them cost no new crate: the
# release wasm (before wasm-opt) went from 4,532,688 to 4,569,272 bytes,
# +36 KB, +11 KB gzipped -- the JWK parsing, not the cryptography.
= { = "jsonwebtoken", = "10.4", = false, = [
"rust_crypto",
] }
# Not used directly: this turns on the browser/Workers randomness backend that
# the RustCrypto keys need, and that otherwise refuses wasm32. chrono's clock
# comes from its default `wasmbind` feature.
= { = "0.2", = ["js"] }
[]
# For testing only, and not part of the crate's public promise: verify tokens
# natively with jsonwebtoken 10 and RustCrypto, the code path a wasm32 build
# (a Cloudflare Worker) takes, so CI can run this crate's tests against it
# without a JavaScript host.
= ["dep:jsonwebtoken10"]
[]
= true
= { = true, = ["full", "test-util"] }