Std.App.Jwt.decodeWithKey
fn
decodeWithKey: Str -> &Std.App.Jwt.PublicKey -> &Std.App.Jwt.JwtValidation -> Int -> Result[Std.App.Jwt.JwtClaims, Std.App.Jwt.JwtError]This is a callable function.
What it does
Verify a token signed with a provider's private key, and read its claims.
This is the direction a service that trusts an identity provider needs, and
the only one it needs: the provider signs, the service checks. Nothing here
can produce a token, which is the point of using a key pair rather than a
shared secret — a service that could sign could impersonate the provider.
The algorithm is taken from the key rather than from the token. A token
naming its own algorithm and being checked with it is the oldest hole in
this format: an attacker changes `RS256` to `HS256`, signs with the public
key as though it were a shared secret, and the token verifies. Here a
header that does not name the key's own algorithm is refused before
anything is computed.
Read the signature
- The text after the name is the type checked by Pudu.
- Read arrows from left to right: inputs come first, and the final type is returned.
- & borrows a value for this call instead of moving or copying it.
- Names inside [ ] are type arguments, such as the item type held by a collection.
- Result makes success and recoverable failure part of the function's type.