Enum AssertionFailure 

#[non_exhaustive]
pub enum AssertionFailure {
    Malformed,
    AlgorithmMismatch,
    BadSignature,
    WrongPrincipal,
    WrongAudience,
    Expired,
    NotYetValid,
    MissingJti,
    Replayed,
    ReplayCheckUnavailable,
}

Available on crate feature client-assertion only.

Why an assertion was refused.

Every one of these becomes the same invalid_client on the wire (RFC 6749 section 5.2), for the same reason authenticate_client collapses “unknown client” and “wrong secret”: telling a caller WHICH check it failed is telling an attacker how to get closer. The distinction exists for the host’s audit channel, where the reader is not the attacker.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Malformed

Not a compact JWS, or longer than MAX_ASSERTION_BYTES and so refused on size before anything is decoded, or its typ says it is some other kind of JWT.

AlgorithmMismatch

The header’s alg is not the one this registration signs with.

BadSignature

The signature did not verify under any registered key.

WrongPrincipal

iss or sub is absent, or is not the client this request claims to be.

WrongAudience

aud names neither this server’s token endpoint nor its issuer.

Expired

exp is absent, has passed, or is further out than this server will track a jti for.

NotYetValid

nbf or iat is in the future by more than CLOCK_SKEW_LEEWAY.

MissingJti

jti is absent or empty, so single use cannot be enforced.

Replayed

This jti has been seen before within the assertion’s own validity window.

ReplayCheckUnavailable

The single-use claim could not be RECORDED, so this assertion was refused without ever being judged: the storage seam behind crate::store::Storage::claim_replay_id failed.

The wire answer is the same invalid_client every other variant collapses to, and the refusal is deliberate — a claim that could not be recorded is a claim that did not happen, and treating a storage outage as “probably fine” would make every assertion replayable for the duration of it. What this variant exists for is the AUDIT channel: through 0.9.0 the outage was reported as AssertionFailure::Replayed, which crate::events::ClientAuthFailure::AssertionInvalid documents as “somebody who has captured a client’s traffic, which is a different incident and a much worse one”. An outage fails every private_key_jwt client at once, so that mislabel turned a store alarm into a burst of this crate’s worst-incident signal.

Trait Implementations

impl Clone for AssertionFailure

fn clone(&self) -> AssertionFailure

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for AssertionFailure

impl Debug for AssertionFailure

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for AssertionFailure

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AssertionFailure

impl Error for AssertionFailure

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl Hash for AssertionFailure

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for AssertionFailure

fn eq(&self, other: &AssertionFailure) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for AssertionFailure