jwt_simple_legacy/
common.rs

1use std::collections::HashSet;
2
3use coarsetime::{Duration, UnixTimeStamp};
4use ct_codecs::{Base64UrlSafeNoPadding, Decoder, Encoder, Hex};
5
6use crate::{claims::DEFAULT_TIME_TOLERANCE_SECS, error::*};
7
8pub const DEFAULT_MAX_TOKEN_LENGTH: usize = 1_000_000;
9
10/// Additional features to enable during verification.
11/// Signatures and token expiration are already automatically verified.
12#[derive(Clone, Debug, PartialEq, Eq)]
13pub struct VerificationOptions {
14    /// Reject tokens created before the given date
15    ///
16    /// For a given user, the time of the last successful authentication can be
17    /// kept in a database, and `reject_before` can then be used to reject
18    /// older (replayed) tokens.
19    pub reject_before: Option<UnixTimeStamp>,
20
21    /// Accept tokens created with a date in the future
22    pub accept_future: bool,
23
24    /// Require a specific subject to be present
25    pub required_subject: Option<String>,
26
27    /// Require a specific key identifier to be present
28    pub required_key_id: Option<String>,
29
30    /// Require a specific public key to be present
31    pub required_public_key: Option<String>,
32
33    /// Require a specific nonce to be present
34    pub required_nonce: Option<String>,
35
36    /// Require the issuer to be present in the set
37    pub allowed_issuers: Option<HashSet<String>>,
38
39    /// Require the audience to be present in the set
40    pub allowed_audiences: Option<HashSet<String>>,
41
42    /// How much clock drift to tolerate when verifying token timestamps
43    pub time_tolerance: Option<Duration>,
44
45    /// Reject tokens created more than `max_validity` ago
46    pub max_validity: Option<Duration>,
47
48    /// Maximum token length to accept
49    pub max_token_length: Option<usize>,
50
51    /// Maximum unsafe, untrusted, unverified JWT header length to accept
52    pub max_header_length: Option<usize>,
53}
54
55impl Default for VerificationOptions {
56    fn default() -> Self {
57        Self {
58            reject_before: None,
59            accept_future: false,
60            required_subject: None,
61            required_key_id: None,
62            required_public_key: None,
63            required_nonce: None,
64            allowed_issuers: None,
65            allowed_audiences: None,
66            time_tolerance: Some(Duration::from_secs(DEFAULT_TIME_TOLERANCE_SECS)),
67            max_validity: None,
68            max_token_length: Some(DEFAULT_MAX_TOKEN_LENGTH),
69            max_header_length: None,
70        }
71    }
72}
73
74/// Unsigned metadata about a key to be attached to tokens.
75/// This information can be freely tampered with by an intermediate party.
76/// Most applications should not need to use this.
77#[derive(Debug, Clone, Default)]
78pub struct KeyMetadata {
79    pub(crate) key_set_url: Option<String>,
80    pub(crate) public_key: Option<String>,
81    pub(crate) certificate_url: Option<String>,
82    pub(crate) certificate_sha1_thumbprint: Option<String>,
83    pub(crate) certificate_sha256_thumbprint: Option<String>,
84}
85
86impl KeyMetadata {
87    /// Add a key set URL to the metadata ("jku")
88    pub fn with_key_set_url(mut self, key_set_url: impl ToString) -> Self {
89        self.key_set_url = Some(key_set_url.to_string());
90        self
91    }
92
93    /// Add a public key to the metadata ("jwk")
94    pub fn with_public_key(mut self, public_key: impl ToString) -> Self {
95        self.public_key = Some(public_key.to_string());
96        self
97    }
98
99    /// Add a certificate URL to the metadata ("x5u")
100    pub fn with_certificate_url(mut self, certificate_url: impl ToString) -> Self {
101        self.certificate_url = Some(certificate_url.to_string());
102        self
103    }
104
105    /// Add a certificate SHA-1 thumbprint to the metadata ("x5t")
106    pub fn with_certificate_sha1_thumbprint(
107        mut self,
108        certificate_sha1_thumbprint: impl ToString,
109    ) -> Result<Self, Error> {
110        let thumbprint = certificate_sha1_thumbprint.to_string();
111        let mut bin = [0u8; 20];
112        if thumbprint.len() == 40 {
113            ensure!(
114                Hex::decode(&mut bin, &thumbprint, None)?.len() == bin.len(),
115                JWTError::InvalidCertThumprint
116            );
117            let thumbprint = Base64UrlSafeNoPadding::encode_to_string(bin)?;
118            self.certificate_sha1_thumbprint = Some(thumbprint);
119            return Ok(self);
120        }
121        ensure!(
122            Base64UrlSafeNoPadding::decode(&mut bin, &thumbprint, None)?.len() == bin.len(),
123            JWTError::InvalidCertThumprint
124        );
125        self.certificate_sha1_thumbprint = Some(thumbprint);
126        Ok(self)
127    }
128
129    /// Add a certificate SHA-256 thumbprint to the metadata ("x5t#256")
130    pub fn with_certificate_sha256_thumbprint(
131        mut self,
132        certificate_sha256_thumbprint: impl ToString,
133    ) -> Result<Self, Error> {
134        let thumbprint = certificate_sha256_thumbprint.to_string();
135        let mut bin = [0u8; 32];
136        if thumbprint.len() == 64 {
137            ensure!(
138                Hex::decode(&mut bin, &thumbprint, None)?.len() == bin.len(),
139                JWTError::InvalidCertThumprint
140            );
141            let thumbprint = Base64UrlSafeNoPadding::encode_to_string(bin)?;
142            self.certificate_sha256_thumbprint = Some(thumbprint);
143            return Ok(self);
144        }
145        ensure!(
146            Base64UrlSafeNoPadding::decode(&mut bin, &thumbprint, None)?.len() == bin.len(),
147            JWTError::InvalidCertThumprint
148        );
149        self.certificate_sha256_thumbprint = Some(thumbprint);
150        Ok(self)
151    }
152}
153
154#[inline(never)]
155pub(crate) fn timingsafe_eq(a: &[u8], b: &[u8]) -> bool {
156    if a.len() != b.len() {
157        return false;
158    }
159    a.iter().zip(b.iter()).fold(0, |c, (x, y)| c | (x ^ y)) == 0
160}
jwt_simple_legacy/common.rs

jwt_simple_legacy/
common.rs
