Struct JwtCfg 

pub struct JwtCfg {
    pub algorithm: String,
    pub secret: String,
    pub public_key_pem: String,
    pub jwks_url: String,
    pub jwks_cache_secs: u64,
    pub issuer: String,
    pub audience: String,
    pub leeway_secs: u64,
}

JWT bearer-token verification. Either a symmetric secret (HS*) or an asymmetric key (RS*/ES*/PS*) supplied as a static public_key_pem or fetched from jwks_url.

Fields

algorithm: String

Expected signature algorithm, e.g. “HS256”, “RS256”, “ES256”. The token’s own alg header must match this (we never trust the token to pick its own algorithm — that is the classic JWT downgrade/alg=none foot-gun).

secret: String

Shared secret for HS* algorithms. Prefer the EDGEGUARD_JWT_SECRET env var over putting it in the config file.

public_key_pem: String

Static PEM public key (SPKI or PKCS#1) for RS*/ES*/PS* verification, as an alternative to jwks_url.

jwks_url: String

JWKS endpoint to fetch verification keys from (RS*/ES*/PS*). Keys are cached and selected by the token’s kid.

jwks_cache_secs: u64

How long (seconds) to cache a fetched JWKS before refetching. Default 300.

issuer: String

If set, the token’s iss claim must equal this.

audience: String

If set, the token’s aud claim must contain this.

leeway_secs: u64

Clock-skew leeway (seconds) applied to exp/nbf validation. Default 60.

Trait Implementations

impl Clone for JwtCfg

fn clone(&self) -> JwtCfg

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JwtCfg

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for JwtCfg

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for JwtCfg

where JwtCfg: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.