2015-07-20 20:38:26 +03:00
|
|
|
package jwt
|
|
|
|
|
2016-04-13 02:19:20 +03:00
|
|
|
import (
|
2016-06-07 04:20:35 +03:00
|
|
|
"fmt"
|
|
|
|
"time"
|
2016-04-13 02:19:20 +03:00
|
|
|
)
|
2015-07-20 20:38:26 +03:00
|
|
|
|
2021-08-03 16:51:01 +03:00
|
|
|
// Claims must just have a Valid method that determines
|
2015-07-20 20:38:26 +03:00
|
|
|
// if the token is invalid for any supported reason
|
|
|
|
type Claims interface {
|
2022-03-26 17:13:03 +03:00
|
|
|
Valid() error
|
2015-07-20 20:38:26 +03:00
|
|
|
}
|
|
|
|
|
2021-08-22 20:23:13 +03:00
|
|
|
// RegisteredClaims are a structured version of the JWT Claims Set,
|
|
|
|
// restricted to Registered Claim Names, as referenced at
|
|
|
|
// https://datatracker.ietf.org/doc/html/rfc7519#section-4.1
|
|
|
|
//
|
|
|
|
// This type can be used on its own, but then additional private and
|
|
|
|
// public claims embedded in the JWT will not be parsed. The typical usecase
|
|
|
|
// therefore is to embedded this in a user-defined claim type.
|
|
|
|
//
|
|
|
|
// See examples for how to use this with your own claim types.
|
|
|
|
type RegisteredClaims struct {
|
|
|
|
// the `iss` (Issuer) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1
|
|
|
|
Issuer string `json:"iss,omitempty"`
|
|
|
|
|
|
|
|
// the `sub` (Subject) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.2
|
|
|
|
Subject string `json:"sub,omitempty"`
|
|
|
|
|
|
|
|
// the `aud` (Audience) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3
|
|
|
|
Audience ClaimStrings `json:"aud,omitempty"`
|
|
|
|
|
|
|
|
// the `exp` (Expiration Time) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4
|
|
|
|
ExpiresAt *NumericDate `json:"exp,omitempty"`
|
|
|
|
|
|
|
|
// the `nbf` (Not Before) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.5
|
|
|
|
NotBefore *NumericDate `json:"nbf,omitempty"`
|
|
|
|
|
|
|
|
// the `iat` (Issued At) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.6
|
|
|
|
IssuedAt *NumericDate `json:"iat,omitempty"`
|
|
|
|
|
|
|
|
// the `jti` (JWT ID) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.7
|
|
|
|
ID string `json:"jti,omitempty"`
|
|
|
|
}
|
|
|
|
|
2022-05-28 23:07:51 +03:00
|
|
|
func (c RegisteredClaims) GetExpiryAt() *NumericDate {
|
|
|
|
return c.ExpiresAt
|
|
|
|
}
|
2021-08-22 20:23:13 +03:00
|
|
|
|
2022-05-28 23:07:51 +03:00
|
|
|
func (c RegisteredClaims) GetNotBefore() *NumericDate {
|
|
|
|
return c.NotBefore
|
|
|
|
}
|
2021-08-22 20:23:13 +03:00
|
|
|
|
2022-05-28 23:07:51 +03:00
|
|
|
func (c RegisteredClaims) GetIssuedAt() *NumericDate {
|
|
|
|
return c.IssuedAt
|
|
|
|
}
|
2021-08-22 20:23:13 +03:00
|
|
|
|
2022-05-28 23:07:51 +03:00
|
|
|
func (c RegisteredClaims) GetAudience() ClaimStrings {
|
|
|
|
return c.Audience
|
|
|
|
}
|
2021-08-22 20:23:13 +03:00
|
|
|
|
2022-05-28 23:07:51 +03:00
|
|
|
func (c RegisteredClaims) GetIssuer() string {
|
|
|
|
return c.Issuer
|
|
|
|
}
|
2021-08-22 20:23:13 +03:00
|
|
|
|
2022-05-28 23:07:51 +03:00
|
|
|
// Valid validates time based claims "exp, iat, nbf".
|
|
|
|
// There is no accounting for clock skew.
|
|
|
|
// As well, if any of the above claims are not in the token, it will still
|
|
|
|
// be considered a valid claim.
|
|
|
|
//
|
|
|
|
// Deprecated: This function should not be called directly, rather a claim should be validated using
|
|
|
|
// the Validator struct.
|
|
|
|
func (c RegisteredClaims) Valid() error {
|
|
|
|
return NewValidator().Validate(c)
|
2021-08-22 20:23:13 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// VerifyAudience compares the aud claim against cmp.
|
|
|
|
// If required is false, this method will return true if the value matches or is unset
|
|
|
|
func (c *RegisteredClaims) VerifyAudience(cmp string, req bool) bool {
|
2022-05-28 23:07:51 +03:00
|
|
|
return NewValidator().VerifyAudience(c, cmp, req)
|
2021-08-22 20:23:13 +03:00
|
|
|
}
|
|
|
|
|
2021-10-10 00:17:39 +03:00
|
|
|
// VerifyExpiresAt compares the exp claim against cmp (cmp < exp).
|
2021-08-22 20:23:13 +03:00
|
|
|
// If req is false, it will return true, if exp is unset.
|
2022-03-26 17:13:03 +03:00
|
|
|
func (c *RegisteredClaims) VerifyExpiresAt(cmp time.Time, req bool) bool {
|
2022-05-28 23:07:51 +03:00
|
|
|
return NewValidator().VerifyExpiresAt(c, cmp, req)
|
2021-08-22 20:23:13 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// VerifyIssuedAt compares the iat claim against cmp (cmp >= iat).
|
|
|
|
// If req is false, it will return true, if iat is unset.
|
|
|
|
func (c *RegisteredClaims) VerifyIssuedAt(cmp time.Time, req bool) bool {
|
2022-05-28 23:07:51 +03:00
|
|
|
return NewValidator().VerifyIssuedAt(c, cmp, req)
|
2021-08-22 20:23:13 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// VerifyNotBefore compares the nbf claim against cmp (cmp >= nbf).
|
|
|
|
// If req is false, it will return true, if nbf is unset.
|
2022-03-26 17:13:03 +03:00
|
|
|
func (c *RegisteredClaims) VerifyNotBefore(cmp time.Time, req bool) bool {
|
2022-05-28 23:07:51 +03:00
|
|
|
return NewValidator().VerifyNotBefore(c, cmp, req)
|
2021-08-22 20:23:13 +03:00
|
|
|
}
|
|
|
|
|
2021-11-24 16:27:41 +03:00
|
|
|
// VerifyIssuer compares the iss claim against cmp.
|
|
|
|
// If required is false, this method will return true if the value matches or is unset
|
|
|
|
func (c *RegisteredClaims) VerifyIssuer(cmp string, req bool) bool {
|
2022-05-28 23:07:51 +03:00
|
|
|
return NewValidator().VerifyIssuer(c, cmp, req)
|
2021-11-24 16:27:41 +03:00
|
|
|
}
|
|
|
|
|
2021-08-22 20:23:13 +03:00
|
|
|
// StandardClaims are a structured version of the JWT Claims Set, as referenced at
|
|
|
|
// https://datatracker.ietf.org/doc/html/rfc7519#section-4. They do not follow the
|
|
|
|
// specification exactly, since they were based on an earlier draft of the
|
|
|
|
// specification and not updated. The main difference is that they only
|
|
|
|
// support integer-based date fields and singular audiences. This might lead to
|
|
|
|
// incompatibilities with other JWT implementations. The use of this is discouraged, instead
|
|
|
|
// the newer RegisteredClaims struct should be used.
|
|
|
|
//
|
|
|
|
// Deprecated: Use RegisteredClaims instead for a forward-compatible way to access registered claims in a struct.
|
2015-07-20 20:38:26 +03:00
|
|
|
type StandardClaims struct {
|
|
|
|
Audience string `json:"aud,omitempty"`
|
|
|
|
ExpiresAt int64 `json:"exp,omitempty"`
|
|
|
|
Id string `json:"jti,omitempty"`
|
|
|
|
IssuedAt int64 `json:"iat,omitempty"`
|
|
|
|
Issuer string `json:"iss,omitempty"`
|
|
|
|
NotBefore int64 `json:"nbf,omitempty"`
|
|
|
|
Subject string `json:"sub,omitempty"`
|
|
|
|
}
|
|
|
|
|
2021-08-03 16:51:01 +03:00
|
|
|
// Valid validates time based claims "exp, iat, nbf". There is no accounting for clock skew.
|
2015-07-20 20:38:26 +03:00
|
|
|
// As well, if any of the above claims are not in the token, it will still
|
|
|
|
// be considered a valid claim.
|
2022-03-26 17:13:03 +03:00
|
|
|
func (c StandardClaims) Valid() error {
|
2015-07-20 20:38:26 +03:00
|
|
|
vErr := new(ValidationError)
|
|
|
|
now := TimeFunc().Unix()
|
|
|
|
|
|
|
|
// The claims below are optional, by default, so if they are set to the
|
|
|
|
// default value in Go, let's not fail the verification for them.
|
2022-03-26 17:13:03 +03:00
|
|
|
if !c.VerifyExpiresAt(now, false) {
|
2016-06-07 04:20:35 +03:00
|
|
|
delta := time.Unix(now, 0).Sub(time.Unix(c.ExpiresAt, 0))
|
2022-02-15 16:31:33 +03:00
|
|
|
vErr.Inner = fmt.Errorf("%s by %s", ErrTokenExpired, delta)
|
2015-07-20 20:38:26 +03:00
|
|
|
vErr.Errors |= ValidationErrorExpired
|
|
|
|
}
|
|
|
|
|
2021-05-28 02:26:21 +03:00
|
|
|
if !c.VerifyIssuedAt(now, false) {
|
2022-01-20 00:55:19 +03:00
|
|
|
vErr.Inner = ErrTokenUsedBeforeIssued
|
2015-07-20 20:38:26 +03:00
|
|
|
vErr.Errors |= ValidationErrorIssuedAt
|
|
|
|
}
|
|
|
|
|
2022-03-26 17:13:03 +03:00
|
|
|
if !c.VerifyNotBefore(now, false) {
|
2022-01-20 00:55:19 +03:00
|
|
|
vErr.Inner = ErrTokenNotValidYet
|
2015-07-20 20:38:26 +03:00
|
|
|
vErr.Errors |= ValidationErrorNotValidYet
|
|
|
|
}
|
|
|
|
|
|
|
|
if vErr.valid() {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return vErr
|
|
|
|
}
|
|
|
|
|
2021-08-03 16:51:01 +03:00
|
|
|
// VerifyAudience compares the aud claim against cmp.
|
2015-07-20 20:38:26 +03:00
|
|
|
// If required is false, this method will return true if the value matches or is unset
|
|
|
|
func (c *StandardClaims) VerifyAudience(cmp string, req bool) bool {
|
2021-05-29 04:45:11 +03:00
|
|
|
return verifyAud([]string{c.Audience}, cmp, req)
|
2015-07-20 20:38:26 +03:00
|
|
|
}
|
|
|
|
|
2021-10-10 00:17:39 +03:00
|
|
|
// VerifyExpiresAt compares the exp claim against cmp (cmp < exp).
|
2021-08-22 11:18:33 +03:00
|
|
|
// If req is false, it will return true, if exp is unset.
|
2022-03-26 17:13:03 +03:00
|
|
|
func (c *StandardClaims) VerifyExpiresAt(cmp int64, req bool) bool {
|
2021-08-22 20:23:13 +03:00
|
|
|
if c.ExpiresAt == 0 {
|
2022-05-28 23:07:51 +03:00
|
|
|
return verifyExp(nil, time.Unix(cmp, 0), req, 0)
|
2021-08-22 20:23:13 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
t := time.Unix(c.ExpiresAt, 0)
|
2022-05-28 23:07:51 +03:00
|
|
|
return verifyExp(&t, time.Unix(cmp, 0), req, 0)
|
2015-07-20 20:38:26 +03:00
|
|
|
}
|
|
|
|
|
2021-08-22 11:18:33 +03:00
|
|
|
// VerifyIssuedAt compares the iat claim against cmp (cmp >= iat).
|
|
|
|
// If req is false, it will return true, if iat is unset.
|
2015-07-20 20:38:26 +03:00
|
|
|
func (c *StandardClaims) VerifyIssuedAt(cmp int64, req bool) bool {
|
2021-08-22 20:23:13 +03:00
|
|
|
if c.IssuedAt == 0 {
|
2022-05-28 23:07:51 +03:00
|
|
|
return verifyIat(nil, time.Unix(cmp, 0), req, 0)
|
2021-08-22 20:23:13 +03:00
|
|
|
}
|
2015-07-20 20:38:26 +03:00
|
|
|
|
2021-08-22 20:23:13 +03:00
|
|
|
t := time.Unix(c.IssuedAt, 0)
|
2022-05-28 23:07:51 +03:00
|
|
|
return verifyIat(&t, time.Unix(cmp, 0), req, 0)
|
2015-07-20 20:38:26 +03:00
|
|
|
}
|
|
|
|
|
2021-08-22 11:18:33 +03:00
|
|
|
// VerifyNotBefore compares the nbf claim against cmp (cmp >= nbf).
|
|
|
|
// If req is false, it will return true, if nbf is unset.
|
2022-03-26 17:13:03 +03:00
|
|
|
func (c *StandardClaims) VerifyNotBefore(cmp int64, req bool) bool {
|
2021-08-22 20:23:13 +03:00
|
|
|
if c.NotBefore == 0 {
|
2022-05-28 23:07:51 +03:00
|
|
|
return verifyNbf(nil, time.Unix(cmp, 0), req, 0)
|
2021-08-22 20:23:13 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
t := time.Unix(c.NotBefore, 0)
|
2022-05-28 23:07:51 +03:00
|
|
|
return verifyNbf(&t, time.Unix(cmp, 0), req, 0)
|
2021-08-22 20:23:13 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// VerifyIssuer compares the iss claim against cmp.
|
|
|
|
// If required is false, this method will return true if the value matches or is unset
|
|
|
|
func (c *StandardClaims) VerifyIssuer(cmp string, req bool) bool {
|
|
|
|
return verifyIss(c.Issuer, cmp, req)
|
2015-07-20 20:38:26 +03:00
|
|
|
}
|