tree 3184dd046c91b42a8d2b1a137f73c339fe26fb0e
parent 0a72f5ee7c2a61bdb379436461269315c776b50a
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1633095418 +0200
committer William Lallemand <wlallemand@haproxy.org> 1634222294 +0200

MEDIUM: jwt: Add jwt_verify converter to verify JWT integrity

This new converter takes a JSON Web Token, an algorithm (among the ones
specified for JWS tokens in RFC 7518) and a public key or a secret, and
it returns a verdict about the signature contained in the token. It does
not simply return a boolean because some specific error cases cas be
specified by returning an integer instead, such as unmanaged algorithms
or invalid tokens. This enables to distinguich malformed tokens from
tampered ones, that would be valid format-wise but would have a bad
signature.
This converter does not perform a full JWT validation as decribed in
section 7.2 of RFC 7519. For instance it does not ensure that the header
and payload parts of the token are completely valid JSON objects because
it would need a complete JSON parser. It only focuses on the signature
and checks that it matches the token's contents.