tokenkit 1.0.1

Type-safe JWT encode/decode for Rust with configurable validation, secret rotation, key rotation, and revocation support
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

# WyattAu dependency governance — cargo-deny configuration.
# Copy to the repo root. Policies: see engineering-standards README §7.

[graph]
all-features = true

[advisories]
version = 2
yanked = "deny"
ignore = [
    # rsa "Marvin Attack" (RSA timing side-channel, private-key recovery).
    # No patched release exists upstream: patched = [] is intentional and both
    # 0.9.10 (latest stable) and 0.10.0-rc.x remain affected (advisory reviewed
    # 2026-09-12), so no in-range bump can resolve it. Enters via jsonwebtoken
    # v11 `rust_crypto` feature, which tokenkit enables for RS256/PS256
    # support; dropping the feature is a functional break, not a deps fix.
    # Exposure is opt-in: the default path is HS256, and JWKS verification is
    # public-key-only (no key-recovery surface). RSA *signing* with a private
    # key over a timing-observable channel remains accepted risk — prefer
    # ES256/EdDSA when caller-controlled. Fleet precedent: EvergreenShims
    # accepts the same advisory.
    # Tracking: https://github.com/RustCrypto/RSA/issues/626 (implicit
    # rejection #680, default-path blinding #702). TODO: remove this ignore
    # and bump rsa as soon as a patched release lands.
    "RUSTSEC-2023-0071",
]

[licenses]
version = 2
allow = [
  "MIT",
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Unicode-3.0",
  "Zlib",
  "CDLA-Permissive-2.0",
]
confidence-threshold = 0.93

[bans]
multiple-versions = "warn"
wildcards = "deny"
highlight = "all"