Skip to content
master
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
t
 
 
 
 
 
 
 
 
 
 
 
 
 
 

README.md

NAME

Crypt::JWT - JSON Web Token (JWT, JWS, JWE) as defined by RFC7519, RFC7515, RFC7516

SYNOPSIS

# encoding
use Crypt::JWT qw(encode_jwt);
my $jws_token = encode_jwt(payload=>$data, alg=>'HS256', key=>'secret');
my $jwe_token = encode_jwt(payload=>$data, alg=>'PBES2-HS256+A128KW', enc=>'A128GCM', key=>'secret');

# decoding
use Crypt::JWT qw(decode_jwt);
my $data1 = decode_jwt(token=>$jws_token, key=>'secret');
my $data2 = decode_jwt(token=>$jwe_token, key=>'secret');

DESCRIPTION

Implements JSON Web Token (JWT) - https://tools.ietf.org/html/rfc7519. The implementation covers not only JSON Web Signature (JWS) - https://tools.ietf.org/html/rfc7515, but also JSON Web Encryption (JWE) - https://tools.ietf.org/html/rfc7516.

The module implements all (100%) algorithms defined in https://tools.ietf.org/html/rfc7518 - JSON Web Algorithms (JWA).

This module supports Compact JWS/JWE and Flattened JWS/JWE JSON serialization, general JSON serialization is not supported yet.

EXPORT

Nothing is exported by default.

You can export selected functions:

use Crypt::JWT qw(decode_jwt encode_jwt);

Or all of them at once:

use Crypt::JWT ':all';

FUNCTIONS

decode_jwt

my $data = decode_jwt(%named_args);

Named arguments:

  • token

    Mandatory argument, a string with either JWS or JWE JSON Web Token.

      ### JWS token example (3 segments)
      $t = "eyJhbGciOiJIUzI1NiJ9.dGVzdA.ujBihtLSr66CEWqN74SpLUkv28lra_CeHnxLmLNp4Jo";
      my $data = decode_jwt(token=>$t, key=>$k);
    
      ### JWE token example (5 segments)
      $t = "eyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiQTEyOEtXIn0.UusxEbzhGkORxTRq0xkFKhvzPrXb9smw.VGfOuq0Fxt6TsdqLZUpnxw.JajIQQ.pkKZ7MHS0XjyGmRsqgom6w";
      my $data = decode_jwt(token=>$t, key=>$k);
    
  • key

    A key used for token decryption (JWE) or token signature validation (JWS). The value depends on the alg token header value.

      JWS alg header      key value
      ------------------  ----------------------------------
      none                no key required
      HS256               string (raw octects) of any length (or perl HASH ref with JWK, kty=>'oct')
      HS384               dtto
      HS512               dtto
      RS256               public RSA key, perl HASH ref with JWK key structure,
                          a reference to SCALAR string with PEM or DER or JSON/JWK data,
                          object: Crypt::PK::RSA, Crypt::OpenSSL::RSA, Crypt::X509 or Crypt::OpenSSL::X509
      RS384               public RSA key, see RS256
      RS512               public RSA key, see RS256
      PS256               public RSA key, see RS256
      PS384               public RSA key, see RS256
      PS512               public RSA key, see RS256
      ES256               public ECC key, perl HASH ref with JWK key structure,
                          a reference to SCALAR string with PEM or DER or JSON/JWK data,
                          an instance of Crypt::PK::ECC
      ES256K              public ECC key, see ES256
      ES384               public ECC key, see ES256
      ES512               public ECC key, see ES256
      EdDSA               public Ed25519 key
    
      JWE alg header      key value
      ------------------  ----------------------------------
      dir                 string (raw octects) or perl HASH ref with JWK, kty=>'oct', length depends on 'enc' algorithm
      A128KW              string (raw octects) 16 bytes (or perl HASH ref with JWK, kty=>'oct')
      A192KW              string (raw octects) 24 bytes (or perl HASH ref with JWK, kty=>'oct')
      A256KW              string (raw octects) 32 bytes (or perl HASH ref with JWK, kty=>'oct')
      A128GCMKW           string (raw octects) 16 bytes (or perl HASH ref with JWK, kty=>'oct')
      A192GCMKW           string (raw octects) 24 bytes (or perl HASH ref with JWK, kty=>'oct')
      A256GCMKW           string (raw octects) 32 bytes (or perl HASH ref with JWK, kty=>'oct')
      PBES2-HS256+A128KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=>'oct')
      PBES2-HS384+A192KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=>'oct')
      PBES2-HS512+A256KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=>'oct')
      RSA-OAEP            private RSA key, perl HASH ref with JWK key structure,
                          a reference to SCALAR string with PEM or DER or JSON/JWK data,
                          an instance of Crypt::PK::RSA or Crypt::OpenSSL::RSA
      RSA-OAEP-256        private RSA key, see RSA-OAEP
      RSA1_5              private RSA key, see RSA-OAEP
      ECDH-ES             private ECC or X25519 key, perl HASH ref with JWK key structure,
                          a reference to SCALAR string with PEM or DER or JSON/JWK data,
                          an instance of Crypt::PK::ECC
      ECDH-ES+A128KW      private ECC or X25519 key, see ECDH-ES
      ECDH-ES+A192KW      private ECC or X25519 key, see ECDH-ES
      ECDH-ES+A256KW      private ECC or X25519 key, see ECDH-ES
    

    Example using the key from jwk token header:

      my $data = decode_jwt(token=>$t, key_from_jwk_header=>1);
      my ($header, $data) = decode_jwt(token=>$t, decode_header=>1, key_from_jwk_header=>1);
    

    Examples with raw octet keys:

      #string
      my $data = decode_jwt(token=>$t, key=>'secretkey');
      #binary key
      my $data = decode_jwt(token=>$t, key=>pack("H*", "788A6E38F36B7596EF6A669E94"));
      #perl HASH ref with JWK structure (key type 'oct')
      my $data = decode_jwt(token=>$t, key=>{kty=>'oct', k=>"GawgguFyGrWKav7AX4VKUg"});
    

    Examples with RSA keys:

      my $pem_key_string = <<'EOF';
      -----BEGIN PRIVATE KEY-----
      MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCoVm/Sl5r+Ofky
      jioRSZK26GW6WyjyfWKddsSi13/NOtCn0rRErSF/u3QrgGMpWFqKohqbi1VVC+SZ
      ...
      8c1vm2YFafgdkSk9Qd1oU2Fv1aOQy4VovOFzJ3CcR+2r7cbRfcpLGnintHtp9yek
      02p+d5g4OChfFNDhDtnIqjvY
      -----END PRIVATE KEY-----
      EOF
    
      my $jwk_key_json_string = '{"kty":"RSA","n":"0vx7agoebG...L6tSoc_BJECP","e":"AQAB"}';
    
      #a reference to SCALAR string with PEM or DER or JSON/JWK data,
      my $data = decode_jwt(token=>$t, key=>\$pem_key_string);
      my $data = decode_jwt(token=>$t, key=>\$der_key_string);
      my $data = decode_jwt(token=>$t, key=>\$jwk_key_json_string);
    
      #instance of Crypt::PK::RSA
      my $data = decode_jwt(token=>$t, key=>Crypt::PK::RSA->new('keyfile.pem'));
      my $data = decode_jwt(token=>$t, key=>Crypt::PK::RSA->new(\$pem_key_string));
    
      #instance of Crypt::OpenSSL::RSA
      my $data = decode_jwt(token=>$t, key=>Crypt::OpenSSL::RSA->new_private_key($pem_key_string));
    
      #instance of Crypt::X509 (public key only)
      my $data = decode_jwt(token=>$t, key=>Crypt::X509->new(cert=>$cert));
    
      #instance of Crypt::OpenSSL::X509 (public key only)
      my $data = decode_jwt(token=>$t, key=>Crypt::OpenSSL::X509->new_from_file('cert.pem'));
      my $data = decode_jwt(token=>$t, key=>Crypt::OpenSSL::X509->new_from_string($cert));
    
      #perl HASH ref with JWK structure (key type 'RSA')
      my $rsa_priv = {
        kty => "RSA",
        n   => "0vx7agoebGcQSuuPiLJXZpt...eZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw",
        e   => "AQAB",
        d   => "X4cTteJY_gn4FYPsXB8rdXi...FLN5EEaG6RoVH-HLKD9Mdx5ooGURknhnrRwUkC7h5fJLMWbFAKLWY2v7B6NqSzUvx0_YSf",
        p   => "83i-7IvMGXoMXCskv73TKr8...Z27zvoj6pbUQyLPBQxtPnwD20-60eTmD2ujMt5PoMrm8RmNhVWtjjMmMjOpSicFHjXOuVI",
        q   => "3dfOR9cuYq-0S-mkFLzgItg...q3hWeMuG0ouqnb3obLyuqjVZQ1dIrdgTnCdYzBcOW5r37AFXjift_NGiovonzhKpoVVS78",
        dp  => "G4sPXkc6Ya9y8oJW9_ILj4...zi_H7TkS8x5SdX3oE0oiYwxIiemTAu0UOa5pgFGyJ4c8t2VF40XRugKTP8akhFo5tA77Qe",
        dq  => "s9lAH9fggBsoFR8Oac2R_E...T2kGOhvIllTE1efA6huUvMfBcpn8lqW6vzzYY5SSF7pMd_agI3G8IbpBUb0JiraRNUfLhc",
        qi  => "GyM_p6JrXySiz1toFgKbWV...4ypu9bMWx3QJBfm0FoYzUIZEVEcOqwmRN81oDAaaBk0KWGDjJHDdDmFW3AN7I-pux_mHZG",
      };
      my $data = decode_jwt(token=>$t, key=>$rsa_priv});
    

    Examples with ECC keys:

      my $pem_key_string = <<'EOF';
      -----BEGIN EC PRIVATE KEY-----
      MHcCAQEEIBG1c3z52T8XwMsahGVdOZWgKCQJfv+l7djuJjgetdbDoAoGCCqGSM49
      AwEHoUQDQgAEoBUyo8CQAFPeYPvv78ylh5MwFZjTCLQeb042TjiMJxG+9DLFmRSM
      lBQ9T/RsLLc+PmpB1+7yPAR+oR5gZn3kJQ==
      -----END EC PRIVATE KEY-----
      EOF
    
      my $jwk_key_json_string = '{"kty":"EC","crv":"P-256","x":"MKB..7D4","y":"4Et..FyM"}';
    
      #a reference to SCALAR string with PEM or DER or JSON/JWK data,
      my $data = decode_jwt(token=>$t, key=>\$pem_key_string);
      my $data = decode_jwt(token=>$t, key=>\$der_key_string);
      my $data = decode_jwt(token=>$t, key=>\$jwk_key_json_string);
    
      #instance of Crypt::PK::ECC
      my $data = decode_jwt(token=>$t, key=>Crypt::PK::ECC->new('keyfile.pem'));
      my $data = decode_jwt(token=>$t, key=>Crypt::PK::ECC->new(\$pem_key_string));
    
      #perl HASH ref with JWK structure (key type 'EC')
      my $ecc_priv = {
        kty => "EC",
        crv => "P-256",
        x   => "MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4",
        y   => "4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM",
        d   => "870MB6gfuTJ4HtUnUvYMyJpr5eUZNP4Bk43bVdj3eAE",
      };
      my $data = decode_jwt(token=>$t, key=>$ecc_priv});
    
  • keypass

    When 'key' parameter is an encrypted private RSA or ECC key this optional parameter may contain a password for private key decryption.

  • kid_keys

    This parametes can be either a JWK Set JSON string (see RFC7517) or a perl HASH ref with JWK Set structure like this:

      my $keylist = {
        keys => [
          { kid=>"key1", kty=>"oct", k=>"GawgguFyGrWKav7AX4VKUg" },
          { kid=>"key2", kty=>"oct", k=>"ulxLGy4XqhbpkR5ObGh1gX" },
        ]
      };
      my $payload = decode_jwt(token=>$t, kid_keys=>$keylist);
    

    The structure described above is used e.g. by https://www.googleapis.com/oauth2/v2/certs

      use Mojo::UserAgent;
      my $ua = Mojo::UserAgent->new;
      my $google_keys => $ua->get('https://www.googleapis.com/oauth2/v2/certs')->result->json;
      my $payload = decode_jwt(token => $t, kid_keys => $google_keys);
    

    SINCE 0.019 we also support alternative structure used e.g. by https://www.googleapis.com/oauth2/v1/certs:

      use LWP::Simple;
      my $google_certs = get('https://www.googleapis.com/oauth2/v1/certs');
      my $payload = decode_jwt(token => $t, kid_keys => $google_certs);
    

    When the token header contains kid item the corresponding key is looked up in kid_keys list and used for token decoding (you do not need to pass the explicit key via key parameter).

    INCOMPATIBLE CHANGE in 0.023: When kid_keys is specified it croaks if token header does not contain kid value or if kid was not found in kid_keys.

  • key_from_jwk_header

    SINCE 0.023

    1 - use jwk header value for validating JWS signature if neither key nor kid_keys specified, BEWARE: DANGEROUS, UNSECURE!!!

    0 (default) - ignore jwk header value when validating JWS signature

    Keep in mind that enabling key_from_jwk_header requires jwk header to exist and be an valid RSA/ECDSA public key (otherwise it croaks).

  • allow_none

    1 - accept JWS tokens with none 'alg' header value (which means that token has no signature), BEWARE: DANGEROUS, UNSECURE!!!

    0 (default) - do not allow JWS with none 'alg' header value

  • ignore_signature

    1 - do not check signature on JWS tokens, BEWARE: DANGEROUS, UNSECURE!!!

    0 (default) - check signature on JWS tokens

  • accepted_alg

    undef (default) means accept all 'alg' algorithms except 'none' (for accepting 'none' use allow_none)

    string name of accepted 'alg' algorithm (only one)

    ARRAY ref a list of accepted 'alg' algorithms

    Regexp that has to match 'alg' algorithm name

      my $payload = decode_jwt(token=>$t, key=>$k, accepted_alg=>'HS256');
      #or
      my $payload = decode_jwt(token=>$t, key=>$k, accepted_alg=>['HS256','HS384']);
      #or
      my $payload = decode_jwt(token=>$t, key=>$k, accepted_alg=>qr/^HS(256|384|512)$/);
    
  • accepted_enc

    undef (default) means accept all 'enc' algorithms

    string name of accepted 'enc' algorithm (only one)

    ARRAY ref a list of accepted 'enc' algorithms

    Regexp that has to match 'enc' algorithm name

      my $payload = decode_jwt(token=>$t, key=>$k, accepted_enc=>'A192GCM');
      #or
      my $payload = decode_jwt(token=>$t, key=>$k, accepted_enc=>['A192GCM','A256GCM']);
      #or
      my $payload = decode_jwt(token=>$t, key=>$k, accepted_enc=>qr/^A(128|192|256)GCM$/);
    
  • decode_payload

    0 - do not decode payload, return it as a raw string (octects).

    1 - decode payload from JSON string, return it as perl hash ref (or array ref) - decode_json failure means fatal error (croak).

    undef (default) - if possible decode payload from JSON string, if decode_json fails return payload as a raw string (octets).

  • decode_header

    0 (default) - do not return decoded header as a return value of decode_jwt()

    1 - return decoded header as a return value of decode_jwt()

      my $payload = decode_jwt(token=>$t, key=>$k);
      #or
      my ($header, $payload) = decode_jwt(token=>$t, key=>$k, decode_header=>1);
    
  • verify_iss

    INCOMPATIBLE CHANGE in 0.024: If verify_iss is specified and claim iss (Issuer) is completely missing it is a failure since 0.024

    CODE ref - subroutine (with 'iss' claim value passed as argument) should return true otherwise verification fails

    Regexp ref - 'iss' claim value has to match given regexp otherwise verification fails

    Scalar - 'iss' claim value has to be equal to given string (since 0.029)

    undef (default) - do not verify 'iss' claim

  • verify_aud

    INCOMPATIBLE CHANGE in 0.024: If verify_aud is specified and claim aud (Audience) is completely missing it is a failure since 0.024

    CODE ref - subroutine (with 'aud' claim value passed as argument) should return true otherwise verification fails

    Regexp ref - 'aud' claim value has to match given regexp otherwise verification fails

    Scalar - 'aud' claim value has to be equal to given string (since 0.029)

    undef (default) - do not verify 'aud' claim

  • verify_sub

    INCOMPATIBLE CHANGE in 0.024: If verify_sub is specified and claim sub (Subject) is completely missing it is a failure since 0.024

    CODE ref - subroutine (with 'sub' claim value passed as argument) should return true otherwise verification fails

    Regexp ref - 'sub' claim value has to match given regexp otherwise verification fails

    Scalar - 'sub' claim value has to be equal to given string (since 0.029)

    undef (default) - do not verify 'sub' claim

  • verify_jti

    INCOMPATIBLE CHANGE in 0.024: If verify_jti is specified and claim jti (JWT ID) is completely missing it is a failure since 0.024

    CODE ref - subroutine (with 'jti' claim value passed as argument) should return true otherwise verification fails

    Regexp ref - 'jti' claim value has to match given regexp otherwise verification fails

    Scalar - 'jti' claim value has to be equal to given string (since 0.029)

    undef (default) - do not verify 'jti' claim

  • verify_iat

    undef - Issued At 'iat' claim must be valid (not in the future) if present

    0 (default) - ignore 'iat' claim

    1 - require valid 'iat' claim

  • verify_nbf

    undef (default) - Not Before 'nbf' claim must be valid if present

    0 - ignore 'nbf' claim

    1 - require valid 'nbf' claim

  • verify_exp

    undef (default) - Expiration Time 'exp' claim must be valid if present

    0 - ignore 'exp' claim

    1 - require valid 'exp' claim

  • leeway

    Tolerance in seconds related to verify_exp, verify_nbf and verify_iat. Default is 0.

  • ignore_claims

    1 - do not check claims (iat, exp, nbf, iss, aud, sub, jti), BEWARE: DANGEROUS, UNSECURE!!!

    0 (default) - check claims

encode_jwt

my $token = encode_jwt(%named_args);

Named arguments:

  • payload

    Value of this mandatory parameter can be a string/buffer or HASH ref or ARRAY ref

      my $token = encode_jwt(payload=>"any raw data", key=>$k, alg=>'HS256');
      #or
      my $token = encode_jwt(payload=>{a=>1,b=>2}, key=>$k, alg=>'HS256');
      #or
      my $token = encode_jwt(payload=>[11,22,33,44], key=>$k, alg=>'HS256');
    

    HASH refs and ARRAY refs payloads are serialized as JSON strings

  • alg

    The 'alg' header value is mandatory for both JWE and JWS tokens.

    Supported JWE 'alg' algorithms:

      dir
      A128KW
      A192KW
      A256KW
      A128GCMKW
      A192GCMKW
      A256GCMKW
      PBES2-HS256+A128KW
      PBES2-HS384+A192KW
      PBES2-HS512+A256KW
      RSA-OAEP
      RSA-OAEP-256
      RSA1_5
      ECDH-ES+A128KW
      ECDH-ES+A192KW
      ECDH-ES+A256KW
      ECDH-ES
    

    Supported JWS algorithms:

      none   ...  no integrity (NOTE: disabled by default)
      HS256  ...  HMAC+SHA256 integrity
      HS384  ...  HMAC+SHA384 integrity
      HS512  ...  HMAC+SHA512 integrity
      RS256  ...  RSA+PKCS1-V1_5 + SHA256 signature
      RS384  ...  RSA+PKCS1-V1_5 + SHA384 signature
      RS512  ...  RSA+PKCS1-V1_5 + SHA512 signature
      PS256  ...  RSA+PSS + SHA256 signature
      PS384  ...  RSA+PSS + SHA384 signature
      PS512  ...  RSA+PSS + SHA512 signature
      ES256  ...  ECDSA + SHA256 signature
      ES256K ...  ECDSA + SHA256 signature
      ES384  ...  ECDSA + SHA384 signature
      ES512  ...  ECDSA + SHA512 signature
      EdDSA  ...  Ed25519 signature
    
  • enc

    The 'enc' header is mandatory for JWE tokens.

    Supported 'enc' algorithms:

      A128GCM
      A192GCM
      A256GCM
      A128CBC-HS256
      A192CBC-HS384
      A256CBC-HS512
    
  • key

    A key used for token encryption (JWE) or token signing (JWS). The value depends on alg token header value.

      JWS alg header      key value
      ------------------  ----------------------------------
      none                no key required
      HS256               string (raw octects) of any length (or perl HASH ref with JWK, kty=>'oct')
      HS384               dtto
      HS512               dtto
      RS256               private RSA key, perl HASH ref with JWK key structure,
                          a reference to SCALAR string with PEM or DER or JSON/JWK data,
                          object: Crypt::PK::RSA, Crypt::OpenSSL::RSA, Crypt::X509 or Crypt::OpenSSL::X509
      RS384               private RSA key, see RS256
      RS512               private RSA key, see RS256
      PS256               private RSA key, see RS256
      PS384               private RSA key, see RS256
      PS512               private RSA key, see RS256
      ES256               private ECC key, perl HASH ref with JWK key structure,
                          a reference to SCALAR string with PEM or DER or JSON/JWK data,
                          an instance of Crypt::PK::ECC
      ES256K              private ECC key, see ES256
      ES384               private ECC key, see ES256
      ES512               private ECC key, see ES256
      EdDSA               private Ed25519 key
    
      JWE alg header      key value
      ------------------  ----------------------------------
      dir                 string (raw octects) or perl HASH ref with JWK, kty=>'oct', length depends on 'enc' algorithm
      A128KW              string (raw octects) 16 bytes (or perl HASH ref with JWK, kty=>'oct')
      A192KW              string (raw octects) 24 bytes (or perl HASH ref with JWK, kty=>'oct')
      A256KW              string (raw octects) 32 bytes (or perl HASH ref with JWK, kty=>'oct')
      A128GCMKW           string (raw octects) 16 bytes (or perl HASH ref with JWK, kty=>'oct')
      A192GCMKW           string (raw octects) 24 bytes (or perl HASH ref with JWK, kty=>'oct')
      A256GCMKW           string (raw octects) 32 bytes (or perl HASH ref with JWK, kty=>'oct')
      PBES2-HS256+A128KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=>'oct')
      PBES2-HS384+A192KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=>'oct')
      PBES2-HS512+A256KW  string (raw octects) of any length (or perl HASH ref with JWK, kty=>'oct')
      RSA-OAEP            public RSA key, perl HASH ref with JWK key structure,
                          a reference to SCALAR string with PEM or DER or JSON/JWK data,
                          an instance of Crypt::PK::RSA or Crypt::OpenSSL::RSA
      RSA-OAEP-256        public RSA key, see RSA-OAEP
      RSA1_5              public RSA key, see RSA-OAEP
      ECDH-ES             public ECC or X25519 key, perl HASH ref with JWK key structure,
                          a reference to SCALAR string with PEM or DER or JSON/JWK data,
                          an instance of Crypt::PK::ECC
      ECDH-ES+A128KW      public ECC or X25519 key, see ECDH-ES
      ECDH-ES+A192KW      public ECC or X25519 key, see ECDH-ES
      ECDH-ES+A256KW      public ECC or X25519 key, see ECDH-ES
    
  • keypass

    When 'key' parameter is an encrypted private RSA or ECC key this optional parameter may contain a password for private key decryption.

  • allow_none

    1 - allow JWS with none 'alg' header value (which means that token has no signature), BEWARE: DANGEROUS, UNSECURE!!!

    0 (default) - do not allow JWS with none 'alg' header value

  • extra_headers

    This optional parameter may contain a HASH ref with items that will be added to JWT header.

    If you want to use PBES2-based 'alg' like PBES2-HS512+A256KW you can set PBES2 salt len (p2s) in bytes and iteration count (p2c) via extra_headers like this:

      my $token = encode_jwt(payload=>$p, key=>$k, alg=>'PBES2-HS512+A256KW', extra_headers=>{p2c=8000, p2s=>32});
      #NOTE: handling of p2s header is a special case, in the end it is replaced with the generated salt
    
  • unprotected_headers

    A hash with additional integrity unprotected headers - JWS and JWE (not available for compact serialization);

  • shared_unprotected_headers

    A hash with additional integrity unprotected headers - JWE only (not available for compact serialization);

  • aad

    Additional Authenticated Data - scalar value with any (even raw octects) data - JWE only (not available for compact serialization);

  • serialization

    Specify serialization method: compat (= default) for Compact JWS/JWE serialization or flattened for Flattened JWS/JWE JSON serialization.

    General JSON serialization is not supported yet.

  • zip

    Compression method, currently 'deflate' is the only one supported. undef (default) means no compression.

      my $token = encode_jwt(payload=>$p, key=>$k, alg=>'HS256', zip=>'deflate');
      #or define compression level
      my $token = encode_jwt(payload=>$p, key=>$k, alg=>'HS256', zip=>['deflate', 9]);
    
  • auto_iat

    1 - set 'iat' (Issued At) claim to current time (epoch seconds since 1970) at the moment of token encoding

    0 (default) - do not set 'iat' claim

    NOTE: claims are part of the payload and can be used only if the payload is a HASH ref!

  • relative_exp

    Set 'exp' claim (Expiration Time) to current time + relative_exp value (in seconds).

    NOTE: claims are part of the payload and can be used only if the payload is a HASH ref!

  • relative_nbf

    Set 'nbf' claim (Not Before) to current time + relative_nbf value (in seconds).

    NOTE: claims are part of the payload and can be used only if the payload is a HASH ref!

SEE ALSO

Crypt::Cipher::AES, Crypt::AuthEnc::GCM, Crypt::PK::RSA, Crypt::PK::ECC, Crypt::KeyDerivation, Crypt::KeyWrap

LICENSE

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

COPYRIGHT

Copyright (c) 2015 DCIT, a.s. http://www.dcit.cz / Karel Miko

About

No description, website, or topics provided.

Resources

License

You can’t perform that action at this time.