A Rust library for verifying Json Web Tokens issued by AWS Cognito
jsonwebtokens-cognito = "0.1.0-alpha"
```rust let keyset = KeySet::new("eu-west-1", "my-user-pool-id")?; let verifier = keyset.newidtokenverifier(&["client-id-0", "client-id-1"]) .stringequals("customclaim0", "value") .stringequals("custom_claim1", "value") .build()?;
let claims = keyset.verify(token, &verifier).await?; ```
This library builds on top of jsonwebtokens token verifiers.
The keyset will fetch from the appropriate .jwks url when verifying the first
token or, alternatively the cache can be primed by calling
keyset.prefetch_jwks()
:
rust
let keyset = KeySet::new("eu-west-1", "my-user-pool-id")?;
keyset.prefetch_jwks().await?;
If you need to perform token verification in a non-async context, or don't
wan't to allow network I/O while verifying tokens then if you have explicitly
prefetched the jwks key set you can verify tokens with try_verify
:
```rust
let keyset = KeySet::new("eu-west-1", "my-user-pool-id")?;
keyset.prefetchjwks().await?;
let verifier = keyset.newidtokenverifier(&["client-id-0", "client-id-1"])
.stringequals("customclaim0", "value")
.stringequals("customclaim1", "value")
.build()?;
let claims = keyset.tryverify(token, verifier).await?; ``` _tryverify() will return a CacheMiss error if the required key has not been prefetched_
A Keyset is Send safe so it can be used for authentication within a multi-threaded server.
```rust let keyset = KeySet::new(AWSREGION, AWSPOOLID)?; let verifier = keyset.newaccesstokenverifier(&[AWSCLIENTID]).build()?;
keyset.verify(&token_str, &verifier).await?; ```
```rust let keyset = KeySet::new(AWSREGION, AWSPOOLID)?; let verifier = keyset.newidtokenverifier(&[AWSCLIENTID]).build()?;
keyset.verify(&token_str, &verifier).await?; ```
```rust let keyset = KeySet::new(AWSREGION, AWSPOOLID)?; let verifier = keyset.newaccesstokenverifier(&[AWSCLIENTID]) .stringequals("myclaim", "foo") .build()?;
keyset.verify(&token_str, &verifier).await?; ```
See jsonwebtokens for more examples of how to verify custom claims.