Struct VerifyConfig 

pub struct VerifyConfig {
    pub now: Option<u64>,
    pub leeway: u64,
    pub label: Option<String>,
    pub required_components: Vec<Component>,
    pub max_age: Option<u64>,
    pub wimse_profile: bool,
    pub expected_audience: Option<String>,
    pub wimse_response_profile: bool,
    pub expected_req_nonce: Option<String>,
}

Options controlling verify.

A bare successful verify proves only that some set of components was signed with the key. To bind the request, set required_components to the components that must be covered — under the WIMSE profile that is @method and @request-target, plus content-type, content-digest, authorization, txn-token and workload-identity-token whenever the message carries them.

Fields

now: Option<u64>

The current time, in seconds since the Unix epoch. When set, created and expires are checked against it.

leeway: u64

Clock-skew tolerance, in seconds.

label: Option<String>

If set, only this signature label is accepted.

required_components: Vec<Component>

Components that MUST be covered by the signature; verification fails if any is absent.

max_age: Option<u64>

If set (together with now), the signature’s created must be present and within this many seconds of now.

wimse_profile: bool

Enforce the WIMSE request-signature profile on the received parameters: created, expires, nonce, tag and wimse-aud must all be present, tag must be WIMSE_TAG, and keyid and alg must be absent.

Off by default so the crate can also be driven as a plain RFC 9421 implementation.

expected_audience: Option<String>

If set, the signature’s wimse-aud must equal this value. A signature is only bound to this service if the audience it names is checked.

wimse_response_profile: bool

Enforce the WIMSE response-signature profile instead of the request one: same mandatory parameters, but wimse-aud is a request-only parameter and wimse-req-nonce is required whenever the client demanded a signed response.

Whether it was demanded is taken from expected_req_nonce being set, since the client that sent the request is the only party that knows, and it is also the only party that can check the returned value.

expected_req_nonce: Option<String>

If set, the response’s wimse-req-nonce must equal this value — the nonce the client put on its own request. Checking it is what stops a response signed for one request being replayed against another.

Trait Implementations

impl Clone for VerifyConfig

fn clone(&self) -> VerifyConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerifyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for VerifyConfig

fn default() -> VerifyConfig

Returns the “default value” for a type.