A digitally signed or MACed JWT

Create a JWS JWT. Specialisation of signJWT with payload type fixed at ClaimsSet.

Does not set any fields in the Claims Set, such as "iat" ("Issued At") Claim. The payload is encoded as-is.

Create a JWS JWT. The payload can be any type with a ToJSON instance. See also signClaims which uses ClaimsSet as the payload type.

Does not set any fields in the Claims Set, such as "iat" ("Issued At") Claim. The payload is encoded as-is.

Acquire the default validation settings.

RFC 7519 §4.1.3. states that applications MUST identify itself with a value in the audience claim, therefore a predicate must be supplied.

The other defaults are:

• defaultValidationSettings for JWS verification
• Zero clock skew tolerance when validating nbf, exp and iat claims
• iat claim is checked
• issuer claim is not checked

Variant of verifyJWT that uses ClaimsSet as the payload type.

Cryptographically verify a JWS JWT, then validate the Claims Set, returning it if valid. The claims are validated at the current system time.

This is the only way to get at the claims of a JWS JWT, enforcing that the claims are cryptographically and semantically valid before the application can use them.

This function is abstracted over any payload type with HasClaimsSet and FromJSON instances. The verifyClaims variant uses ClaimsSet as the payload type.

See also verifyClaimsAt which allows you to explicitly specify the time of validation (against which time-related claims will be validated).

Maximum allowed skew when validating the nbf, exp and iat claims.

Predicate for checking values in the aud claim.

Predicate for checking the iss claim.

Whether to check that the iat claim is not in the future.

Variant of verifyJWT that uses ClaimsSet as the payload type and where validation time is provided by caller.

Variant of verifyJWT where the validation time is provided by caller. If you process many tokens per second this lets you avoid unnecessary repeat system calls.

The JWT Claims Set represents a JSON object whose members are the registered claims defined by RFC 7519. To construct a ClaimsSet use emptyClaimsSet then use the lenses defined in HasClaimsSet to set relevant claims.

For applications that use additional claims beyond those defined by RFC 7519, define a subtype and instance HasClaimsSet.

Return an empty claims set.

Validate the claims made by a ClaimsSet.

You should never need to use this function directly. These checks are always performed by verifyClaims and verifyJWT. The function is exported mainly for testing purposes.

Add a non-RFC 7519 claim. Use the lenses from the HasClaimsSet class for setting registered claims.

Claim Names can be defined at will by those using JWTs. Use this lens to access a map non-RFC 7519 claims in the Claims Set object.

Audience data. In the general case, the aud value is an array of case-sensitive strings, each containing a StringOrURI value. In the special case when the JWT has one audience, the aud value MAY be a single case-sensitive string containing a StringOrURI value.

The ToJSON instance formats an Audience with one value as a string (some non-compliant implementations require this.)

A JSON string value, with the additional requirement that while arbitrary string values MAY be used, any value containing a : character MUST be a URI.

Note: the IsString instance will fail if the string contains a : but does not parse as a URI. Use stringOrUri directly in this situation.

A JSON numeric value representing the number of seconds from 1970-01-01T0:0:0Z UTC until the specified UTC date/time.