Libjwt.JwtValidation

Validation of JWT claims

Documentation

data ValidationSettings

User-defined parameters of an validation

Constructors

Settings

Fields

• leeway :: NominalDiffTime

  extends the token validity period to [nbf - leeway, exp + leeway) (also works for iat checks such as checkAge)

• appName :: Maybe String

  used for aud checks: if aud claim is present, it must contain the value of this param

Instances

Show ValidationSettings

Defined in Libjwt.JwtValidation

Methods

showsPrec :: Int -> ValidationSettings -> ShowS

show :: ValidationSettings -> String

showList :: [ValidationSettings] -> ShowS

defaultValidationSettings :: ValidationSettings

ValidationSettings with leeway set to 0 and appName set to Nothing

runValidation

Arguments

:: MonadTime m

=> ValidationSettings

leeway and appName

-> JwtValidation pc any

v

-> Payload pc any

payload

-> m (ValidationNEL ValidationFailure Valid)

Run checks against the payload.

The exact set of checks is: defaultValidationRules <> v , where v is passed to this function and defaultValidationRules is:

• check exp claim against the current time (minus possible leeway),
• check nbf claim against the current time (plus possible leeway),
• check aud claim against appName

See the docs of ValidationFailure for a list of possible errors.

type ValidationNEL a b = Validation (NonEmpty a) b

data Valid

Instances

Show Valid

Defined in Libjwt.JwtValidation

Methods

showsPrec :: Int -> Valid -> ShowS

show :: Valid -> String

showList :: [Valid] -> ShowS

Semigroup Valid

Defined in Libjwt.JwtValidation

Methods

(<>) :: Valid -> Valid -> Valid

sconcat :: NonEmpty Valid -> Valid

stimes :: Integral b => b -> Valid -> Valid

type Check pc ns = Payload pc ns -> ValidationNEL ValidationFailure Valid

data JwtValidation pc any

Instances

Semigroup (JwtValidation pc any)

Defined in Libjwt.JwtValidation

Methods

(<>) :: JwtValidation pc any -> JwtValidation pc any -> JwtValidation pc any

sconcat :: NonEmpty (JwtValidation pc any) -> JwtValidation pc any

stimes :: Integral b => b -> JwtValidation pc any -> JwtValidation pc any

Monoid (JwtValidation any1 any2)

Defined in Libjwt.JwtValidation

Methods

mempty :: JwtValidation any1 any2

mappend :: JwtValidation any1 any2 -> JwtValidation any1 any2 -> JwtValidation any1 any2

mconcat :: [JwtValidation any1 any2] -> JwtValidation any1 any2

validation :: Check pc any -> JwtValidation pc any

Construct validation from function

invalid

Arguments

:: ValidationFailure

reason

-> ValidationNEL ValidationFailure Valid

Validation that always fails and signals reason

valid :: ValidationNEL ValidationFailure Valid

Validation that is always valid

checkIssuer

Arguments

:: String

issuer

-> JwtValidation any1 any2

Check that iss is present and equal to issuer. If not, then signal InvalidClaim "iss"

checkSubject

Arguments

:: String

subject

-> JwtValidation any1 any2

Check that sub is present and equal to subject. If not, then signal InvalidClaim "sub"

checkAge

Arguments

:: NominalDiffTime

maxAge

-> JwtValidation any1 any2

Check that iat (if present) is not further than maxAge from currentTime (minus possible leeway). Otherwise signal TokenTooOld.

checkIssuedAfter

Arguments

:: UTCTime

time

-> JwtValidation any1 any2

Check that iat (if present) is after time. If false, signal InvalidClaim "iat".

checkJwtId

Arguments

:: UUID

jwtId

-> JwtValidation any1 any2

Check that jti is present and equal to jwtId. If not, then signal InvalidClaim "jti"

checkClaim

Arguments

:: (CanGet n pc, a ~ LookupClaimType n pc)

=> (a -> Bool)

p

-> ClaimName n

n

-> JwtValidation pc any

Check that p a == True, where a is a value of private claim n. If not, signal InvalidClaim n

Example:

checkClaim not #is_root

check

Arguments

:: String

claim

-> (a -> Bool)

p

-> (Payload pc any -> a)

prop

-> JwtValidation pc any

Check the property prop of a payload with the predicate p

If p is False, then signal InvalidClaim claim

data ValidationFailure

Reasons for rejecting a JWT token

Constructors

InvalidClaim String

User check failed

TokenExpired NominalDiffTime

exp check failed: the current time was after or equal to the expiration time (plus possible leeway)

TokenNotReady NominalDiffTime

nbf check failed: the current time was before the not-before time (minus possible leeway)

WrongRecipient

aud check failed: the application processing this claim did not identify itself (appName) with a value in the aud claim

TokenTooOld NominalDiffTime

iat check failed: the current time minus the time the JWT was issued (plus possible leeway) was greater than expected

Instances

Eq ValidationFailure

Defined in Libjwt.JwtValidation

Methods

(==) :: ValidationFailure -> ValidationFailure -> Bool

(/=) :: ValidationFailure -> ValidationFailure -> Bool

Show ValidationFailure

Defined in Libjwt.JwtValidation

Methods

showsPrec :: Int -> ValidationFailure -> ShowS

show :: ValidationFailure -> String

showList :: [ValidationFailure] -> ShowS