class

Authly::StrategyTokenVerifier

Inherits Authly::TokenVerifier < Reference < Object

Verifies with a Configuration (the global one by default), decoding the token once: signature (the configured algorithm, never the token's alg header), exp, nbf, iss and the revocation store for JWTs; the token store for opaque tokens.

Only access tokens pass: token_type must be access_token. A refresh token is signed with the same key but is not one. Tokens issued before token_type existed are accepted only with legacy_tokens: true (they must still carry a scope), for the length of access_ttl after an upgrade.

With an audience, the token's aud must contain it. Without one any audience passes, so a token minted for one API is accepted by every API sharing the key: set it.

Constants

ACCESS_TOKEN = "access_token"

Constructors

new(config : Configuration = Authly.config, audience : String | Nil = nil, legacy_tokens : Bool = false)

Source

Instance methods

verify(token : String) : Claims | Nil

The claims of a valid access token, nil for a token that is not one. Raises VerificationUnavailable when it cannot tell.

Source