Skip to main content

Crate jwtk

Crate jwtk 

Source
Expand description

JWT signing (JWS) and verification, with first class JWK and JWK Set (JWKS) support.

§Algorithms

  • RS256, RS384, RS512, PS256, PS384, PS512 (verification: aws-lc or openssl; signing: openssl)
  • HS256, HS384, HS512 (feature: openssl)
  • ES256, ES384, ES512, ES256K (feature: openssl)
  • Ed25519 (feature: openssl)

Supports exp and nbf validations. (Other validations will not be supported, because they are mostly application specific and can be easily implemented by applications.)

Supports converting public/private keys to/from JWK. PEM support is available when the openssl feature is enabled. Supports working with generic keys (where the algorithm is determined at runtime), i.e. SomePrivateKey/SomePublicKey.

§Features

FeatureDefaultDescription
aws-lcYesRSA signature verification via aws-lc-rs.
opensslNoFull algorithm support (RSA signing & verification, HMAC, ECDSA, EdDSA) via OpenSSL. When enabled, RSA uses OpenSSL instead of aws-lc-rs.
remote-jwksYesRemoteJwksVerifier for fetching and caching remote JWK Sets.

With the default features (aws-lc + remote-jwks), RSA JWT verification works out of the box.

§Examples

See the examples folder for usage examples.

Modules§

jwk
JWK and JWK Set.
rsa

Structs§

Claims
JWT Claims.
Header
JWT header.
HeaderAndClaims
JWT header and claims.
OneOrManyIter

Enums§

Error
OneOrMany
SomePrivateKey
An RSA, EC or Ed25519 private key.
SomePublicKey
An RSA, EC or Ed25519 public key.

Constants§

URL_SAFE_TRAILING_BITS

Traits§

PrivateKeyToJwk
PublicKeyToJwk
SigningKey
VerificationKey

Functions§

decode_without_verify
Decode token.
sign
Encode and sign this header and claims with the signing key.
verify
Decode and verify token.
verify_only
Decode and verify token, but do not check exp and nbf.

Type Aliases§

Result