Crypto.JWT

JSON Web Token implementation.

Documentation

data JWT

JSON Web Token data.

Constructors

JWT

Fields

• jwtCrypto :: JWTCrypto

  JOSE aspect of the JWT.

• jwtClaimsSet :: ClaimsSet

  Claims of the JWT.

Instances

Eq JWT

Methods

(==) :: JWT -> JWT -> Bool

(/=) :: JWT -> JWT -> Bool

Show JWT

Methods

showsPrec :: Int -> JWT -> ShowS

show :: JWT -> String

showList :: [JWT] -> ShowS

ToCompact JWT

Methods

toCompact :: (AsError e, MonadError e m) => JWT -> m [ByteString]

FromCompact JWT

Methods

fromCompact :: (AsError e, MonadError e m) => [ByteString] -> m JWT

data JWTCrypto

Data representing the JOSE aspects of a JWT.

Constructors

JWTJWS (JWS JWSHeader)

Instances

Eq JWTCrypto

Methods

(==) :: JWTCrypto -> JWTCrypto -> Bool

(/=) :: JWTCrypto -> JWTCrypto -> Bool

Show JWTCrypto

Methods

showsPrec :: Int -> JWTCrypto -> ShowS

show :: JWTCrypto -> String

showList :: [JWTCrypto] -> ShowS

ToCompact JWTCrypto

Methods

toCompact :: (AsError e, MonadError e m) => JWTCrypto -> m [ByteString]

FromCompact JWTCrypto

Methods

fromCompact :: (AsError e, MonadError e m) => [ByteString] -> m JWTCrypto

data JWTError

Constructors

JWSError Error

JWTExpired

JWTNotYetValid

JWTNotInIssuer

JWTNotInAudience

JWTIssuedAtFuture

Instances

Eq JWTError

Methods

(==) :: JWTError -> JWTError -> Bool

(/=) :: JWTError -> JWTError -> Bool

Show JWTError

Methods

showsPrec :: Int -> JWTError -> ShowS

show :: JWTError -> String

showList :: [JWTError] -> ShowS

AsError JWTError

Methods

_Error :: Prism' JWTError Error

_AlgorithmNotImplemented :: Prism' JWTError ()

_AlgorithmMismatch :: Prism' JWTError String

_KeyMismatch :: Prism' JWTError String

_KeySizeTooSmall :: Prism' JWTError ()

_OtherPrimesNotSupported :: Prism' JWTError ()

_RSAError :: Prism' JWTError Error

_CryptoError :: Prism' JWTError CryptoError

_CompactEncodeError :: Prism' JWTError String

_CompactDecodeError :: Prism' JWTError String

_JSONDecodeError :: Prism' JWTError String

_JWSCritUnprotected :: Prism' JWTError ()

_JWSNoValidSignatures :: Prism' JWTError ()

_JWSInvalidSignature :: Prism' JWTError ()

_JWSNoSignatures :: Prism' JWTError ()

AsJWTError JWTError

Methods

_JWTError :: Prism' JWTError JWTError

_JWSError :: Prism' JWTError Error

_JWTExpired :: Prism' JWTError ()

_JWTNotYetValid :: Prism' JWTError ()

_JWTNotInIssuer :: Prism' JWTError ()

_JWTNotInAudience :: Prism' JWTError ()

_JWTIssuedAtFuture :: Prism' JWTError ()

class AsJWTError r where

Methods

_JWTError :: Prism' r JWTError

_JWSError :: Prism' r Error

_JWTExpired :: Prism' r ()

_JWTNotYetValid :: Prism' r ()

_JWTNotInIssuer :: Prism' r ()

_JWTNotInAudience :: Prism' r ()

_JWTIssuedAtFuture :: Prism' r ()

Instances

AsJWTError JWTError

Methods

_JWTError :: Prism' JWTError JWTError

_JWSError :: Prism' JWTError Error

_JWTExpired :: Prism' JWTError ()

_JWTNotYetValid :: Prism' JWTError ()

_JWTNotInIssuer :: Prism' JWTError ()

_JWTNotInAudience :: Prism' JWTError ()

_JWTIssuedAtFuture :: Prism' JWTError ()

data JWTValidationSettings

Instances

HasValidationSettings JWTValidationSettings

Methods

validationSettings :: Lens' JWTValidationSettings ValidationSettings

validationSettingsAlgorithms :: Lens' JWTValidationSettings (Set Alg)

validationSettingsValidationPolicy :: Lens' JWTValidationSettings ValidationPolicy

HasJWTValidationSettings JWTValidationSettings

Methods

jWTValidationSettings :: Lens' JWTValidationSettings JWTValidationSettings

jwtValidationSettingsAllowedSkew :: Lens' JWTValidationSettings NominalDiffTime

jwtValidationSettingsAudiencePredicate :: Lens' JWTValidationSettings (StringOrURI -> Bool)

jwtValidationSettingsCheckIssuedAt :: Lens' JWTValidationSettings Bool

jwtValidationSettingsIssuerPredicate :: Lens' JWTValidationSettings (StringOrURI -> Bool)

jwtValidationSettingsValidationSettings :: Lens' JWTValidationSettings ValidationSettings

defaultJWTValidationSettings :: JWTValidationSettings

class HasJWTValidationSettings c where

Minimal complete definition

jWTValidationSettings

Methods

jWTValidationSettings :: Lens' c JWTValidationSettings

jwtValidationSettingsAllowedSkew :: Lens' c NominalDiffTime

jwtValidationSettingsAudiencePredicate :: Lens' c (StringOrURI -> Bool)

jwtValidationSettingsCheckIssuedAt :: Lens' c Bool

jwtValidationSettingsIssuerPredicate :: Lens' c (StringOrURI -> Bool)

jwtValidationSettingsValidationSettings :: Lens' c ValidationSettings

Instances

HasJWTValidationSettings JWTValidationSettings

Methods

jWTValidationSettings :: Lens' JWTValidationSettings JWTValidationSettings

jwtValidationSettingsAllowedSkew :: Lens' JWTValidationSettings NominalDiffTime

jwtValidationSettingsAudiencePredicate :: Lens' JWTValidationSettings (StringOrURI -> Bool)

jwtValidationSettingsCheckIssuedAt :: Lens' JWTValidationSettings Bool

jwtValidationSettingsIssuerPredicate :: Lens' JWTValidationSettings (StringOrURI -> Bool)

jwtValidationSettingsValidationSettings :: Lens' JWTValidationSettings ValidationSettings

class HasAllowedSkew s where

Minimal complete definition

allowedSkew

Methods

allowedSkew :: Lens' s NominalDiffTime

Instances

HasJWTValidationSettings a => HasAllowedSkew a

Methods

allowedSkew :: Lens' a NominalDiffTime

class HasAudiencePredicate s where

Minimal complete definition

audiencePredicate

Methods

audiencePredicate :: Lens' s (StringOrURI -> Bool)

Instances

HasJWTValidationSettings a => HasAudiencePredicate a

Methods

audiencePredicate :: Lens' a (StringOrURI -> Bool)

class HasIssuerPredicate s where

Minimal complete definition

issuerPredicate

Methods

issuerPredicate :: Lens' s (StringOrURI -> Bool)

Instances

HasJWTValidationSettings a => HasIssuerPredicate a

Methods

issuerPredicate :: Lens' a (StringOrURI -> Bool)

class HasCheckIssuedAt s where

Minimal complete definition

checkIssuedAt

Methods

checkIssuedAt :: Lens' s Bool

Instances

HasJWTValidationSettings a => HasCheckIssuedAt a

Methods

checkIssuedAt :: Lens' a Bool

createJWSJWT :: (MonadRandom m, MonadError e m, AsError e) => JWK -> JWSHeader -> ClaimsSet -> m JWT

Create a JWT that is a JWS.

validateJWSJWT :: (MonadTime m, HasAllowedSkew a, HasAudiencePredicate a, HasIssuerPredicate a, HasCheckIssuedAt a, HasValidationSettings a, AsError e, AsJWTError e, MonadError e m) => a -> JWK -> JWT -> m ()

Validate a JWT as a JWS (JSON Web Signature), then as a Claims Set.

data ClaimsSet

The JWT Claims Set represents a JSON object whose members are the claims conveyed by the JWT.

Constructors

ClaimsSet

Fields

• _claimIss :: Maybe StringOrURI

  The issuer claim identifies the principal that issued the JWT. The processing of this claim is generally application specific.

• _claimSub :: Maybe StringOrURI

  The subject claim identifies the principal that is the subject of the JWT. The Claims in a JWT are normally statements about the subject. The subject value MAY be scoped to be locally unique in the context of the issuer or MAY be globally unique. The processing of this claim is generally application specific.

• _claimAud :: Maybe Audience

  The audience claim identifies the recipients that the JWT is intended for. Each principal intended to process the JWT MUST identify itself with a value in the audience claim. If the principal processing the claim does not identify itself with a value in the aud claim when this claim is present, then the JWT MUST be rejected.

• _claimExp :: Maybe NumericDate

  The expiration time claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. The processing of exp claim requires that the current date/time MUST be before expiration date/time listed in the exp claim. Implementers MAY provide for some small leeway, usually no more than a few minutes, to account for clock skew.

• _claimNbf :: Maybe NumericDate

  The not before claim identifies the time before which the JWT MUST NOT be accepted for processing. The processing of the nbf claim requires that the current date/time MUST be after or equal to the not-before date/time listed in the nbf claim. Implementers MAY provide for some small leeway, usually no more than a few minutes, to account for clock skew.

• _claimIat :: Maybe NumericDate

  The issued at claim identifies the time at which the JWT was issued. This claim can be used to determine the age of the JWT.

• _claimJti :: Maybe Text

  The JWT ID claim provides a unique identifier for the JWT. The identifier value MUST be assigned in a manner that ensures that there is a negligible probability that the same value will be accidentally assigned to a different data object. The jti claim can be used to prevent the JWT from being replayed. The jti value is a case-sensitive string.

• _unregisteredClaims :: HashMap Text Value

  Claim Names can be defined at will by those using JWTs.

Instances

Eq ClaimsSet

Methods

(==) :: ClaimsSet -> ClaimsSet -> Bool

(/=) :: ClaimsSet -> ClaimsSet -> Bool

Show ClaimsSet

Methods

showsPrec :: Int -> ClaimsSet -> ShowS

show :: ClaimsSet -> String

showList :: [ClaimsSet] -> ShowS

ToJSON ClaimsSet

Methods

toJSON :: ClaimsSet -> Value

toEncoding :: ClaimsSet -> Encoding

toJSONList :: [ClaimsSet] -> Value

toEncodingList :: [ClaimsSet] -> Encoding

FromJSON ClaimsSet

Methods

parseJSON :: Value -> Parser ClaimsSet

parseJSONList :: Value -> Parser [ClaimsSet]

claimAud :: Lens' ClaimsSet (Maybe Audience)

claimExp :: Lens' ClaimsSet (Maybe NumericDate)

claimIat :: Lens' ClaimsSet (Maybe NumericDate)

claimIss :: Lens' ClaimsSet (Maybe StringOrURI)

claimJti :: Lens' ClaimsSet (Maybe Text)

claimNbf :: Lens' ClaimsSet (Maybe NumericDate)

claimSub :: Lens' ClaimsSet (Maybe StringOrURI)

unregisteredClaims :: Lens' ClaimsSet (HashMap Text Value)

addClaim :: Text -> Value -> ClaimsSet -> ClaimsSet

emptyClaimsSet :: ClaimsSet

Return an empty claims set.

validateClaimsSet :: (MonadTime m, HasAllowedSkew a, HasAudiencePredicate a, HasIssuerPredicate a, HasCheckIssuedAt a, AsJWTError e, MonadError e m) => a -> ClaimsSet -> m ()

Validate the claims made by a ClaimsSet. Currently only inspects the exp and nbf claims. N.B. These checks are also performed by validateJWSJWT, which also validates any signatures, so you shouldn’t need to use this directly in the normal course of things.

newtype Audience

Audience data. In the general case, the aud value is an array of case-sensitive strings, each containing a StringOrURI value. In the special case when the JWT has one audience, the aud value MAY be a single case-sensitive string containing a StringOrURI value.

Constructors

Audience [StringOrURI]

Instances

Eq Audience

Methods

(==) :: Audience -> Audience -> Bool

(/=) :: Audience -> Audience -> Bool

Show Audience

Methods

showsPrec :: Int -> Audience -> ShowS

show :: Audience -> String

showList :: [Audience] -> ShowS

ToJSON Audience

Methods

toJSON :: Audience -> Value

toEncoding :: Audience -> Encoding

toJSONList :: [Audience] -> Value

toEncodingList :: [Audience] -> Encoding

FromJSON Audience

Methods

parseJSON :: Value -> Parser Audience

parseJSONList :: Value -> Parser [Audience]

data StringOrURI

A JSON string value, with the additional requirement that while arbitrary string values MAY be used, any value containing a : character MUST be a URI.

Instances

Eq StringOrURI

Methods

(==) :: StringOrURI -> StringOrURI -> Bool

(/=) :: StringOrURI -> StringOrURI -> Bool

Show StringOrURI

Methods

showsPrec :: Int -> StringOrURI -> ShowS

show :: StringOrURI -> String

showList :: [StringOrURI] -> ShowS

IsString StringOrURI

Methods

fromString :: String -> StringOrURI

ToJSON StringOrURI

Methods

toJSON :: StringOrURI -> Value

toEncoding :: StringOrURI -> Encoding

toJSONList :: [StringOrURI] -> Value

toEncodingList :: [StringOrURI] -> Encoding

FromJSON StringOrURI

Methods

parseJSON :: Value -> Parser StringOrURI

parseJSONList :: Value -> Parser [StringOrURI]

fromString :: Text -> StringOrURI

Construct a StringOrURI from text

fromURI :: URI -> StringOrURI

Construct a StringOrURI from a URI

getString :: StringOrURI -> Maybe Text

Get the

getURI :: StringOrURI -> Maybe URI

Get the uri from a StringOrURI

newtype NumericDate

A JSON numeric value representing the number of seconds from 1970-01-01T0:0:0Z UTC until the specified UTC date/time.

Constructors

NumericDate UTCTime

Instances

Eq NumericDate

Methods

(==) :: NumericDate -> NumericDate -> Bool

(/=) :: NumericDate -> NumericDate -> Bool

Ord NumericDate

Methods

compare :: NumericDate -> NumericDate -> Ordering

(<) :: NumericDate -> NumericDate -> Bool

(<=) :: NumericDate -> NumericDate -> Bool

(>) :: NumericDate -> NumericDate -> Bool

(>=) :: NumericDate -> NumericDate -> Bool

max :: NumericDate -> NumericDate -> NumericDate

min :: NumericDate -> NumericDate -> NumericDate

Show NumericDate

Methods

showsPrec :: Int -> NumericDate -> ShowS

show :: NumericDate -> String

showList :: [NumericDate] -> ShowS

ToJSON NumericDate

Methods

toJSON :: NumericDate -> Value

toEncoding :: NumericDate -> Encoding

toJSONList :: [NumericDate] -> Value

toEncodingList :: [NumericDate] -> Encoding

FromJSON NumericDate

Methods

parseJSON :: Value -> Parser NumericDate

parseJSONList :: Value -> Parser [NumericDate]