Class: JWT::EncodedToken
- Inherits:
-
Object
- Object
- JWT::EncodedToken
- Defined in:
- lib/jwt/encoded_token.rb
Overview
Represents an encoded JWT token
Processing an encoded and signed token:
token = JWT::Token.new(payload: {pay: 'load'})
token.sign!(algorithm: 'HS256', key: 'secret')
encoded_token = JWT::EncodedToken.new(token.jwt)
encoded_token.verify_signature!(algorithm: 'HS256', key: 'secret')
encoded_token.payload # => {'pay' => 'load'}
Instance Attribute Summary collapse
-
#encoded_header ⇒ String
readonly
Returns the encoded header of the JWT token.
-
#encoded_payload ⇒ String
Sets or returns the encoded payload of the JWT token.
-
#encoded_signature ⇒ String
readonly
Returns the encoded signature of the JWT token.
-
#jwt ⇒ String
(also: #to_s)
readonly
Returns the original token provided to the class.
Instance Method Summary collapse
-
#claim_errors(*options) ⇒ Array<Symbol>
Returns the errors of the claims of the token.
-
#header ⇒ Hash
Returns the decoded header of the JWT token.
-
#initialize(jwt) ⇒ EncodedToken
constructor
Initializes a new EncodedToken instance.
-
#payload ⇒ Hash
Returns the payload of the JWT token.
-
#signature ⇒ String
Returns the decoded signature of the JWT token.
-
#signing_input ⇒ String
Returns the signing input of the JWT token.
-
#unverified_payload ⇒ Hash
Returns the payload of the JWT token without requiring the signature to have been verified.
-
#valid_claims?(*options) ⇒ Boolean
Returns whether the claims of the token are valid.
-
#valid_signature?(algorithm:, key:) ⇒ Boolean
Checks if the signature of the JWT token is valid.
-
#verify!(signature:, claims: [:exp]) ⇒ nil
Verifies the token signature and claims.
-
#verify_claims!(*options) ⇒ Object
Verifies the claims of the token.
-
#verify_signature!(algorithm:, key: nil, key_finder: nil) ⇒ nil
Verifies the signature of the JWT token.
Constructor Details
#initialize(jwt) ⇒ EncodedToken
Initializes a new EncodedToken instance.
39 40 41 42 43 44 45 |
# File 'lib/jwt/encoded_token.rb', line 39 def initialize(jwt) raise ArgumentError, 'Provided JWT must be a String' unless jwt.is_a?(String) @jwt = jwt @signature_verified = false @encoded_header, @encoded_payload, @encoded_signature = jwt.split('.') end |
Instance Attribute Details
#encoded_header ⇒ String (readonly)
Returns the encoded header of the JWT token.
69 70 71 |
# File 'lib/jwt/encoded_token.rb', line 69 def encoded_header @encoded_header end |
#encoded_payload ⇒ String
Sets or returns the encoded payload of the JWT token.
90 91 92 |
# File 'lib/jwt/encoded_token.rb', line 90 def encoded_payload @encoded_payload end |
#encoded_signature ⇒ String (readonly)
Returns the encoded signature of the JWT token.
57 58 59 |
# File 'lib/jwt/encoded_token.rb', line 57 def encoded_signature @encoded_signature end |
#jwt ⇒ String (readonly) Also known as: to_s
Returns the original token provided to the class.
33 34 35 |
# File 'lib/jwt/encoded_token.rb', line 33 def jwt @jwt end |
Instance Method Details
#claim_errors(*options) ⇒ Array<Symbol>
Returns the errors of the claims of the token.
158 159 160 |
# File 'lib/jwt/encoded_token.rb', line 158 def claim_errors(*) Claims::Verifier.errors(ClaimsContext.new(self), *) end |
#header ⇒ Hash
Returns the decoded header of the JWT token.
62 63 64 |
# File 'lib/jwt/encoded_token.rb', line 62 def header @header ||= parse_and_decode(@encoded_header) end |
#payload ⇒ Hash
Returns the payload of the JWT token. Access requires the signature to have been verified.
75 76 77 78 79 |
# File 'lib/jwt/encoded_token.rb', line 75 def payload raise JWT::DecodeError, 'Verify the token signature before accessing the payload' unless @signature_verified decoded_payload end |
#signature ⇒ String
Returns the decoded signature of the JWT token.
50 51 52 |
# File 'lib/jwt/encoded_token.rb', line 50 def signature @signature ||= ::JWT::Base64.url_decode(encoded_signature || '') end |
#signing_input ⇒ String
Returns the signing input of the JWT token.
95 96 97 |
# File 'lib/jwt/encoded_token.rb', line 95 def signing_input [encoded_header, encoded_payload].join('.') end |
#unverified_payload ⇒ Hash
Returns the payload of the JWT token without requiring the signature to have been verified.
83 84 85 |
# File 'lib/jwt/encoded_token.rb', line 83 def unverified_payload decoded_payload end |
#valid_claims?(*options) ⇒ Boolean
Returns whether the claims of the token are valid.
165 166 167 |
# File 'lib/jwt/encoded_token.rb', line 165 def valid_claims?(*) claim_errors(*).empty? end |
#valid_signature?(algorithm:, key:) ⇒ Boolean
Checks if the signature of the JWT token is valid.
138 139 140 141 142 143 144 145 146 |
# File 'lib/jwt/encoded_token.rb', line 138 def valid_signature?(algorithm:, key:) valid = Array(JWA.resolve_and_sort(algorithms: algorithm, preferred_algorithm: header['alg'])).any? do |algo| Array(key).any? do |one_key| algo.verify(data: signing_input, signature: signature, verification_key: one_key) end end valid.tap { |verified| @signature_verified = verified } end |
#verify!(signature:, claims: [:exp]) ⇒ nil
Verifies the token signature and claims. By default it verifies the ‘exp’ claim.
109 110 111 112 113 |
# File 'lib/jwt/encoded_token.rb', line 109 def verify!(signature:, claims: [:exp]) verify_signature!(**signature) claims.is_a?(Array) ? verify_claims!(*claims) : verify_claims!(claims) nil end |
#verify_claims!(*options) ⇒ Object
Verifies the claims of the token.
151 152 153 |
# File 'lib/jwt/encoded_token.rb', line 151 def verify_claims!(*) Claims::Verifier.verify!(ClaimsContext.new(self), *) end |
#verify_signature!(algorithm:, key: nil, key_finder: nil) ⇒ nil
Verifies the signature of the JWT token.
123 124 125 126 127 128 129 130 131 |
# File 'lib/jwt/encoded_token.rb', line 123 def verify_signature!(algorithm:, key: nil, key_finder: nil) raise ArgumentError, 'Provide either key or key_finder, not both or neither' if key.nil? == key_finder.nil? key ||= key_finder.call(self) return if valid_signature?(algorithm: algorithm, key: key) raise JWT::VerificationError, 'Signature verification failed' end |