jwks

package
v0.34.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jan 8, 2026 License: MIT Imports: 15 Imported by: 0

Documentation

Overview

Package jwks contains clients for getting public keys from JWKS.

Index

Constants

View Source
const DefaultCacheTTL = time.Hour * 1

DefaultCacheTTL is the default time-to-live for cached JWKS entries. After this duration, cached entries are considered expired and will be refreshed. This prevents revoked keys from remaining in cache indefinitely.

View Source
const DefaultCacheUpdateMinInterval = time.Minute * 1

Variables

This section is empty.

Functions

This section is empty.

Types

type CachingClient

type CachingClient struct {
	// contains filtered or unexported fields
}

CachingClient is a Client for getting keys from remote JWKS with a caching mechanism.

func NewCachingClient

func NewCachingClient() *CachingClient

NewCachingClient returns a new Client that can cache fetched data.

func NewCachingClientWithOpts

func NewCachingClientWithOpts(opts CachingClientOpts) *CachingClient

NewCachingClientWithOpts returns a new Client that can cache fetched data with options.

func (*CachingClient) GetRSAPublicKey

func (cc *CachingClient) GetRSAPublicKey(ctx context.Context, issuerURL, keyID string) (interface{}, error)

GetRSAPublicKey searches JWK with passed key ID in JWKS and returns decoded RSA public key for it. The last one can be used for verifying JWT signature. Obtained JWKS is cached. If passed issuer URL or key ID is not found in the cache, JWKS will be fetched again, but not more than once in a some (configurable) period of time.

func (*CachingClient) InvalidateCacheIfPossible added in v0.31.0

func (cc *CachingClient) InvalidateCacheIfPossible(ctx context.Context, issuerURL string) (invalidated bool, err error)

InvalidateCacheIfPossible does cache invalidation for specific issuer URL if possible. It returns true if the cache was invalidated, false if invalidation was skipped due to rate limiting.

type CachingClientOpts

type CachingClientOpts struct {
	ClientOpts

	// CacheUpdateMinInterval is a minimal interval between cache updates for the same issuer.
	CacheUpdateMinInterval time.Duration

	// CacheTTL is the time-to-live for cached JWKS entries.
	// After this duration, cached entries expire and will be refreshed on next access.
	// This prevents revoked keys from remaining in cache indefinitely.
	// Default: DefaultCacheTTL (1 hour).
	CacheTTL time.Duration
}

CachingClientOpts contains options for CachingClient.

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client gets public keys from remote JWKS. It uses jwks_uri field from /.well-known/openid-configuration endpoint. NOTE: CachingClient should be used in a typical service to avoid making HTTP requests on each JWT verification.

func NewClient

func NewClient() *Client

NewClient returns a new Client.

func NewClientWithOpts

func NewClientWithOpts(opts ClientOpts) *Client

NewClientWithOpts returns a new Client with options.

func (*Client) GetRSAPublicKey

func (c *Client) GetRSAPublicKey(ctx context.Context, issuerURL, keyID string) (interface{}, error)

GetRSAPublicKey gets JWK from JWKS and returns decoded RSA public key. The last one can be used for verifying JWT signature.

type ClientOpts

type ClientOpts struct {
	// HTTPClient is an HTTP client for making requests.
	HTTPClient *http.Client

	// LoggerProvider is a function that provides a logger for the Client.
	LoggerProvider func(ctx context.Context) log.FieldLogger

	// PrometheusLibInstanceLabel is a label for Prometheus metrics.
	// It allows distinguishing metrics from different instances of the same library.
	PrometheusLibInstanceLabel string
}

ClientOpts contains options for the JWKS client.

type GetJWKSError

type GetJWKSError struct {
	Inner                  error
	URL                    string
	OpenIDConfigurationURL string
}

GetJWKSError is an error that may occur during getting JWKS.

func (*GetJWKSError) Error

func (e *GetJWKSError) Error() string

func (*GetJWKSError) Unwrap

func (e *GetJWKSError) Unwrap() error

type GetOpenIDConfigurationError

type GetOpenIDConfigurationError struct {
	Inner error
	URL   string
}

GetOpenIDConfigurationError is an error that may occur during getting openID configuration for issuer.

func (*GetOpenIDConfigurationError) Error

func (*GetOpenIDConfigurationError) Unwrap

func (e *GetOpenIDConfigurationError) Unwrap() error

type JWKNotFoundError

type JWKNotFoundError struct {
	IssuerURL string
	KeyID     string
}

JWKNotFoundError is an error that occurs when JWK is not found by kid.

func (*JWKNotFoundError) Error

func (e *JWKNotFoundError) Error() string

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL