Skip to content

github.com/faustbrian/go-authentication/jwt v1.0.0

Choose a tag to compare

View all tags
@faustbrian faustbrian released this 26 Aug 06:10
· 4 commits to main since this release
jwt/v1.0.0
9f3aa6f

1.0.0 - 2026-08-25

Security

  • Use one clock instant for every claim check in a validation attempt, reject
    fractional and exponent NumericDate encodings that invite parser-dependent
    rounding, and preserve private JSON numbers losslessly instead of exposing
    rounded float64 values.
  • Require verification-only JWK operations, treat conflicting max-age
    directives as immediately stale, and keep remote work permanently rejected
    after close begins even when a close attempt is canceled.
  • Make the default remote HTTP transport safe, reject typed-nil transports,
    and complete successful remote-cache initialization with exactly one bounded
    request.
  • Preserve the last validated remote key set across hostile refresh responses,
    prove old-key eviction and outage recovery, and ensure unknown key IDs never
    trigger attacker-driven fetches.
  • Require canonical unpadded base64url signatures and JSON-number NumericDate
    claims; add exact subject allowlists and custom required-claim policy, and
    reject configurations whose claim bound cannot hold every required claim.
  • Reject build-tag-dependent ES256K so the published algorithm matrix remains
    completely executable under the module's canonical build.
  • Keep safe standards error categories while replacing provider and transport
    causes with a stable redacted key-provider category.
  • Route automatic JWKS refresh through the configured hardened client,
    serialize it with explicit refresh work, detach provider lifetime from the
    constructor context, honor freshness directives and response age, and avoid
    body-limit arithmetic overflow.
  • Reject invalid UTF-8 in protected headers and claim sets instead of allowing
    JSON decoding to replace malformed bytes.
  • Enforce algorithm-specific HMAC sizes, RSA modulus bounds, exact EC curves,
    public-only asymmetric verification keys, and reject token-provided key
    references, unpaired Unicode surrogates, and oversized JSON numbers.
  • Bound remote JWK headers, bodies, key counts, initialization, and concurrent
    operations; reject redirects and compression; validate responses before
    caching; deep-copy returned sets; coalesce refreshes; and independently
    jitter refresh schedules across provider instances.

Documentation

  • Link the package README to the repository-wide Golib documentation portal.

  • Add the stable JWT, JOSE, JSON, remote-JWKS, cache, lifecycle, and diagnostic
    specification decision register with executable evidence links.

  • Document strict claim and algorithm policy, local and remote key ownership,
    fail-stale refresh behavior, cancellation, close semantics, error redaction,
    adoption, migration, security tradeoffs, and compatibility.

Interoperability

  • Add full signed-payload and cache-header fuzz boundaries alongside the
    compact-token and remote-response fuzz targets.
  • Add the RFC 7515 Appendix A.2 RS256 compact JWS and bidirectional
    golang-jwt interoperability for every shared HMAC, RSA, PSS, and ECDSA
    algorithm.
  • Verify bidirectional HS256 compatibility with golang-jwt v5 in addition to
    the pinned RFC 7520 JWK vector and lestrrat-go/jwx implementation.

Distribution

  • Include the canonical MIT licence in the independently published module.

Compatibility

  • Added a pinned module export baseline so incompatible public API changes
    fail the canonical repository gate.

Changed

  • Publish the module from its standalone github.com/faustbrian/go-authentication/jwt identity while preserving its documented API and behavior.

  • Refresh local v0.0.0 owned-module checksums after dependency manifests and
    release notes were normalized; runtime behavior and public APIs are
    unchanged.

  • Require owned sibling modules at local v0.0.0; clean external consumers
    pin each module to an exact main pseudo-version.

  • Refresh owned-module checksums against the final consolidated archives.

  • Normalized standalone module metadata against the canonical owned dependency
    graph, including complete checksums for clean consumer resolution.

  • Refreshed the canonical authentication checksum after its test archive
    changed, preserving isolated module verification.

  • Refreshed the canonical authentication checksum after its API compatibility
    baseline was normalized to the module boundary.

Release integrity

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

Assets 9
Loading