jwt/ruby-jwt
Ruby Jwt
This is a Ruby implementation library for encoding, decoding, and verifying JSON Web Tokens according to the RFC 7519 standard. It provides the primary tools for token signing and encoding, integrity verification, and the extraction of payloads and headers.
The project includes a comprehensive JSON Web Key manager for importing, exporting, and resolving key sets. This system facilitates the generation of key thumbprints and the resolution of specific verification keys based on token identifiers.
The library covers a wide range of security validation mechanisms, including the verification of token signatures via secret keys, public keys, or X.509 certificates. It implements a validation pipeline for reserved and custom claims, checking fields such as issuer, audience, expiration, issue time, and subject.
Extensibility is supported through a framework for integrating custom cryptographic algorithms and the ability to define custom token headers.
Features
- JWT Authentications - Implements secure authentication and session management using signed JSON Web Tokens with custom claims.
- JWT Signing and Verification - Implements full verification of JWT signatures and claims to ensure token integrity.
- JSON Web Key Management - Provides a full system for importing, exporting, and resolving cryptographic keys using the JWK standard.
- JWT Integrity Validations - Validates the cryptographic signature and integrity of JSON Web Tokens using configured signing methods and keys.
- Multi-Issuer Configurations - Verifies that the issuer claim in a token matches an expected value to confirm the identity of the provider.
- JWK Set Organization - Provides a system for organizing collections of JSON Web Keys to facilitate discovery and rotation.
- Digital Signature Verifications - Implements general-purpose verification of cryptographic signatures using public keys, secret keys, or certificates to ensure data integrity.
- Token Subject Specifications - Validates that the subject claim in a token is present and meets the required identity criteria.
- Key Resolution - Identifies and retrieves the specific public key from a key set required to verify a token signature.
- JWT Claim Validation - Implements a validation pipeline to verify reserved claims such as expiration, issuer, and audience.
- Claim Validators - Verifies both standard reserved claims and custom claims to ensure token validity and intent.
- Issuer and Audience Validators - Validates the audience claim in a token to ensure it matches the expected recipient.
- JWT Implementation Libraries - Provides a full Ruby implementation for encoding, decoding, and verifying JSON Web Tokens according to RFC 7519.
- Token Signature Verification - Validates the authenticity of a token using certificates or key finders to ensure data integrity.
- Token Claim Verifications - A verification process ensuring the issued-at claim in a token is valid and the timestamp is correct.
- Expiring Tokens - Detects when a token has passed its expiration date to block the use of expired credentials.
- API Access Security - Provides mechanisms to secure API access by validating signed tokens to ensure requests originate from authorized systems.
- Custom Algorithm Extensions - Allows the integration of custom signing and verification logic through a standard algorithm extension framework.
- Certificate Verification - Validates token signatures using X.509 certificates provided in the header against trusted root authorities.
- External Identity Provider Integration - Provides helpers for verifying tokens issued by third-party identity services by resolving key sets and validating claims.
- JSON Web Key Imports - Provides utilities for loading and parsing JSON Web Key sets into cryptographic key objects.
- Key Thumbprinting - Calculates deterministic, URL-safe hashes of web keys to create unique identifiers.
- JWT Decoders - Extracts the payload and header from a token without requiring cryptographic signature verification.
- Cryptographic Key Resolvers - Retrieves the correct cryptographic key for a token by matching the key identifier in the header.
- Key Resolution Services - A utility for retrieving the specific verification key associated with a token identifier to enable cryptographic validation.
- OAuth Token Management - Provides tools for managing the lifecycle of tokens used to authenticate users and verify identity claims.
- Secure Token Exchange - Enables the exchange of trusted data between services using signed or encrypted tokens to prevent tampering.
- Token Validation - Checks the token identifier (jti) claim to prevent token reuse or spoofing attacks.
- Authentication and OAuth - Implements JSON Web Token standards in Ruby.
