validator.go

package jwt

import (
"fmt"
"time"
)

// ClaimsValidator is an interface that can be implemented by custom claims who
// wish to execute any additional claims validation based on
// application-specific logic. The Validate function is then executed in
// addition to the regular claims validation and any error returned is appended
// to the final validation result.
//
// type MyCustomClaims struct {
// Foo string `json:"foo"`
// jwt.RegisteredClaims
// }
//
// func (m MyCustomClaims) Validate() error {
// if m.Foo != "bar" {
// return errors.New("must be foobar")
// }
// return nil
// }
typeClaimsValidatorinterface {
Claims
Validate() error
}

// Validator is the core of the new Validation API. It is automatically used by
// a [Parser] during parsing and can be modified with various parser options.
//
// The [NewValidator] function should be used to create an instance of this
// struct.
typeValidatorstruct {
// leeway is an optional leeway that can be provided to account for clock skew.
leeway time.Duration

// timeFunc is used to supply the current time that is needed for
// validation. If unspecified, this defaults to time.Now.
timeFuncfunc() time.Time

// requireExp specifies whether the exp claim is required
requireExpbool

// verifyIat specifies whether the iat (Issued At) claim will be verified.
// According to https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 this
// only specifies the age of the token, but no validation check is
// necessary. However, if wanted, it can be checked if the iat is
// unrealistic, i.e., in the future.
verifyIatbool

// expectedAud contains the audience this token expects. Supplying an empty
// slice will disable aud checking.
expectedAud []string

// expectAllAud specifies whether all expected audiences must be present in
// the token. If false, only one of the expected audiences must be present.
expectAllAudbool

// expectedIss contains the issuer this token expects. Supplying an empty
// string will disable iss checking.
expectedIssstring

// expectedSub contains the subject this token expects. Supplying an empty
// string will disable sub checking.
expectedSubstring
}

// NewValidator can be used to create a stand-alone validator with the supplied
// options. This validator can then be used to validate already parsed claims.
//
// Note: Under normal circumstances, explicitly creating a validator is not
// needed and can potentially be dangerous; instead functions of the [Parser]
// class should be used.
//
// The [Validator] is only checking the *validity* of the claims, such as its
// expiration time, but it does NOT perform *signature verification* of the
// token.
funcNewValidator(opts...ParserOption) *Validator {
p:=NewParser(opts...)
returnp.validator
}

// Validate validates the given claims. It will also perform any custom
// validation if claims implements the [ClaimsValidator] interface.
//
// Note: It will NOT perform any *signature verification* on the token that
// contains the claims and expects that the [Claim] was already successfully
// verified.
func (v*Validator) Validate(claimsClaims) error {
var (
now time.Time
errs=make([]error, 0, 6)
errerror
 )

// Check, if we have a time func
ifv.timeFunc!=nil {
now=v.timeFunc()
 } else {
now=time.Now()
 }

// We always need to check the expiration time, but usage of the claim
// itself is OPTIONAL by default. requireExp overrides this behavior
// and makes the exp claim mandatory.
iferr=v.verifyExpiresAt(claims, now, v.requireExp); err!=nil {
errs=append(errs, err)
 }

// We always need to check not-before, but usage of the claim itself is
// OPTIONAL.
iferr=v.verifyNotBefore(claims, now, false); err!=nil {
errs=append(errs, err)
 }

// Check issued-at if the option is enabled
ifv.verifyIat {
iferr=v.verifyIssuedAt(claims, now, false); err!=nil {
errs=append(errs, err)
 }
 }

// If we have an expected audience, we also require the audience claim
iflen(v.expectedAud) >0 {
iferr=v.verifyAudience(claims, v.expectedAud, v.expectAllAud, true); err!=nil {
errs=append(errs, err)
 }
 }

// If we have an expected issuer, we also require the issuer claim
ifv.expectedIss!="" {
iferr=v.verifyIssuer(claims, v.expectedIss, true); err!=nil {
errs=append(errs, err)
 }
 }

// If we have an expected subject, we also require the subject claim
ifv.expectedSub!="" {
iferr=v.verifySubject(claims, v.expectedSub, true); err!=nil {
errs=append(errs, err)
 }
 }

// Finally, we want to give the claim itself some possibility to do some
// additional custom validation based on a custom Validate function.
cvt, ok:=claims.(ClaimsValidator)
ifok {
iferr:=cvt.Validate(); err!=nil {
errs=append(errs, err)
 }
 }

iflen(errs) ==0 {
returnnil
 }

returnjoinErrors(errs...)
}

// verifyExpiresAt compares the exp claim in claims against cmp. This function
// will succeed if cmp < exp. Additional leeway is taken into account.
//
// If exp is not set, it will succeed if the claim is not required,
// otherwise ErrTokenRequiredClaimMissing will be returned.
//
// Additionally, if any error occurs while retrieving the claim, e.g., when its
// the wrong type, an ErrTokenUnverifiable error will be returned.
func (v*Validator) verifyExpiresAt(claimsClaims, cmp time.Time, requiredbool) error {
exp, err:=claims.GetExpirationTime()
iferr!=nil {
returnerr
 }

ifexp==nil {
returnerrorIfRequired(required, "exp")
 }

returnerrorIfFalse(cmp.Before((exp.Time).Add(+v.leeway)), ErrTokenExpired)
}

// verifyIssuedAt compares the iat claim in claims against cmp. This function
// will succeed if cmp >= iat. Additional leeway is taken into account.
//
// If iat is not set, it will succeed if the claim is not required,
// otherwise ErrTokenRequiredClaimMissing will be returned.
//
// Additionally, if any error occurs while retrieving the claim, e.g., when its
// the wrong type, an ErrTokenUnverifiable error will be returned.
func (v*Validator) verifyIssuedAt(claimsClaims, cmp time.Time, requiredbool) error {
iat, err:=claims.GetIssuedAt()
iferr!=nil {
returnerr
 }

ifiat==nil {
returnerrorIfRequired(required, "iat")
 }

returnerrorIfFalse(!cmp.Before(iat.Add(-v.leeway)), ErrTokenUsedBeforeIssued)
}

// verifyNotBefore compares the nbf claim in claims against cmp. This function
// will return true if cmp >= nbf. Additional leeway is taken into account.
//
// If nbf is not set, it will succeed if the claim is not required,
// otherwise ErrTokenRequiredClaimMissing will be returned.
//
// Additionally, if any error occurs while retrieving the claim, e.g., when its
// the wrong type, an ErrTokenUnverifiable error will be returned.
func (v*Validator) verifyNotBefore(claimsClaims, cmp time.Time, requiredbool) error {
nbf, err:=claims.GetNotBefore()
iferr!=nil {
returnerr
 }

ifnbf==nil {
returnerrorIfRequired(required, "nbf")
 }

returnerrorIfFalse(!cmp.Before(nbf.Add(-v.leeway)), ErrTokenNotValidYet)
}

// verifyAudience compares the aud claim against cmp.
//
// If aud is not set or an empty list, it will succeed if the claim is not required,
// otherwise ErrTokenRequiredClaimMissing will be returned.
//
// Additionally, if any error occurs while retrieving the claim, e.g., when its
// the wrong type, an ErrTokenUnverifiable error will be returned.
func (v*Validator) verifyAudience(claimsClaims, cmp []string, expectAllAudbool, requiredbool) error {
aud, err:=claims.GetAudience()
iferr!=nil {
returnerr
 }

iflen(aud) ==0 {
returnerrorIfRequired(required, "aud")
 }

// use a var here to keep constant time compare when looping over a number of claims
matching:=make(map[string]bool, 0)

// build a matching hashmap out of the expected aud
for_, expected:=rangecmp {
matching[expected] =false
 }

// compare the expected aud with the actual aud in a constant time manner by looping over all actual values
varstringClaimsstring
for_, a:=rangeaud {
a:=a
_, ok:=matching[a]
ifok {
matching[a] =true
 }

stringClaims=stringClaims+a
 }

// check if all expected auds are present
result:=true
for_, match:=rangematching {
if!expectAllAud&&match {
break
 } elseif!match {
result=false
 }
 }

// case where "" is sent in one or many aud claims
ifstringClaims=="" {
returnerrorIfRequired(required, "aud")
 }

returnerrorIfFalse(result, ErrTokenInvalidAudience)
}

// verifyIssuer compares the iss claim in claims against cmp.
//
// If iss is not set, it will succeed if the claim is not required,
// otherwise ErrTokenRequiredClaimMissing will be returned.
//
// Additionally, if any error occurs while retrieving the claim, e.g., when its
// the wrong type, an ErrTokenUnverifiable error will be returned.
func (v*Validator) verifyIssuer(claimsClaims, cmpstring, requiredbool) error {
iss, err:=claims.GetIssuer()
iferr!=nil {
returnerr
 }

ifiss=="" {
returnerrorIfRequired(required, "iss")
 }

returnerrorIfFalse(iss==cmp, ErrTokenInvalidIssuer)
}

// verifySubject compares the sub claim against cmp.
//
// If sub is not set, it will succeed if the claim is not required,
// otherwise ErrTokenRequiredClaimMissing will be returned.
//
// Additionally, if any error occurs while retrieving the claim, e.g., when its
// the wrong type, an ErrTokenUnverifiable error will be returned.
func (v*Validator) verifySubject(claimsClaims, cmpstring, requiredbool) error {
sub, err:=claims.GetSubject()
iferr!=nil {
returnerr
 }

ifsub=="" {
returnerrorIfRequired(required, "sub")
 }

returnerrorIfFalse(sub==cmp, ErrTokenInvalidSubject)
}

// errorIfFalse returns the error specified in err, if the value is true.
// Otherwise, nil is returned.
funcerrorIfFalse(valuebool, errerror) error {
ifvalue {
returnnil
 } else {
returnerr
 }
}

// errorIfRequired returns an ErrTokenRequiredClaimMissing error if required is
// true. Otherwise, nil is returned.
funcerrorIfRequired(requiredbool, claimstring) error {
ifrequired {
returnnewError(fmt.Sprintf("%s claim is required", claim), ErrTokenRequiredClaimMissing)
 } else {
returnnil
 }
}