Close closes the Redis connection.

NewValidationError creates a new ValidationError with the given code and message.

New creates a new Validator with the provided options. Required options: - WithKeyFunc: Function to provide verification key(s) - WithAlgorithm: Sign

WithKeyFunc sets the function that provides the key for token verification. This is a required option. The keyFunc is called during token validation

WithAlgorithm sets the signature algorithm that tokens must use. This is a required option. Supported algorithms: RS256, RS384, RS512, ES256, ES384,

WithIssuer sets a single expected issuer claim (iss) for token validation. This is a required option (use either WithIssuer, WithIssuers, or WithIssue

New creates a new Core instance with the provided options. The Core must be configured with at least a TokenValidator using WithValidator. All other

WithValidator sets the validator for the Core. This is a required option. The validator must implement both ValidateToken and ValidateDPoPProof method

WithAudience sets a single expected audience claim (aud) for token validation. This is a required option (use either WithAudience or WithAudiences, no

Get retrieves a JWKS from the cache or fetches it if not cached.

KeyFunc adheres to the keyFunc signature that the Validator requires. While it returns an interface to adhere to keyFunc, as long as the error is nil

NewMultiIssuerProvider creates a new MultiIssuerProvider. This provider automatically routes JWKS requests to the correct issuer based on the validate

WithValidator configures the middleware with a JWT validator. This is the REQUIRED way to configure the middleware. The validator must implement Vali

CheckTokenWithDPoP validates an access token with optional DPoP proof. This is the primary validation method that handles both Bearer and DPoP tokens.

WithIssuerURL sets the OIDC issuer URL for JWKS discovery. This is a required option. The issuer URL is used to discover the JWKS endpoint via the .w

New constructs a new JWTMiddleware instance with the supplied options. All parameters are passed via options (pure options pattern). Required options

CheckJWT is the main JWTMiddleware function which performs the main logic. It is passed a http.Handler which will be called if the JWT passes validati

Context returns the wrapped context with JWT claims.

New creates a new gRPC JWT interceptor with the provided options. WithValidator option is required. Example: interceptor, err := grpc.New( grp

NewCachingProvider builds and returns a new CachingProvider. The cache automatically handles background refresh. Accepts both ProviderOption and Cach

WithValidator sets the JWT validator (REQUIRED). This is the primary way to configure the interceptor. For advanced configuration (logging, error han

KeyFunc adheres to the keyFunc signature that the Validator requires. It automatically routes JWKS requests to the correct issuer based on the validat

WithCacheTTL sets the cache refresh interval for the CachingProvider. If not specified, defaults to 15 minutes. The TTL determines the minimum interv

SetIssuerInContext stores the issuer in the context. This is primarily used for testing purposes. In production, the issuer is automatically set by Va

UnaryServerInterceptor returns a grpc.UnaryServerInterceptor that validates JWTs. It extracts the JWT from gRPC metadata, validates it, and makes the

DefaultErrorHandler maps JWT validation errors to appropriate gRPC status codes. It returns gRPC status errors that follow standard gRPC error handlin

String returns a string representation of the DPoP mode.

WithAudiences sets multiple expected audience claims (aud) for token validation. This is a required option (use either WithAudience or WithAudiences,

WithLogger sets an optional logger for the Core. When configured, the Core will log debug information about token extraction, validation success/fail

createTestValidator creates a basic validator for testing

WithLogger sets an optional logger for the middleware. The logger will be used throughout the validation flow in both middleware and core. The logger

computeAccessTokenHash computes the SHA-256 hash of the access token and returns it as a base64url-encoded string (without padding) per RFC 9449. This

logError logs an error message if the logger is configured.

Helper function to create a mock OIDC server

createDPoPBoundToken creates a DPoP-bound access token with cnf claim

GetWellKnownEndpointsFromIssuerURL gets the well known endpoints for the passed in issuer url and validates that the metadata's issuer field exactly m

ProviderCount returns the total number of issuers currently managed. This includes both OIDC providers (cached dynamically) and symmetric issuers (con

WithCustomClaims sets a function that returns a CustomClaims object for unmarshalling and validation. The function is called during construction to v

createDPoPProofWithAccessToken creates a DPoP proof with ATH claim (RFC 9449 compliant)

reconstructRequestURL builds the full request URL for DPoP HTU validation. It respects the TrustedProxyConfig to determine which headers to trust. Wh

WithDPoPMode configures the DPoP operational mode. Modes: - DPoPAllowed (default): Accept both Bearer and DPoP tokens - DPoPRequired: Only accept DPo

SetClaims stores claims in the context. This is a helper function for adapters to set claims after validation.

WithAllowedClockSkew sets the allowed clock skew for time-based claims. This allows for some tolerance when validating exp, nbf, and iat claims to ac

WithIssuerKeyConfig configures a symmetric key for a single issuer. This enables MCD (Multiple Custom Domains) scenarios where some issuers use symmet

setupHandlerWithConfig creates a handler with custom proxy configuration for testing

Is allows the error to support equality to ErrJWTInvalid.

buildWWWAuthenticateHeaders builds appropriate WWW-Authenticate headers based on auth scheme and DPoP mode. Returns both Bearer and DPoP challenges in

Sends a greeting (requires authentication)

SetAuthScheme stores the authorization scheme in the context. This is used by adapters to track which auth scheme was used in the request.

ValidateDPoPProof validates a DPoP proof JWT and returns the extracted claims. It verifies the JWT signature using the embedded JWK and calculates the

WithTokenExtractor sets the function to extract the JWT from the request. Default: AuthHeaderTokenExtractor

NewProvider builds and returns a new *Provider. Required options: - WithIssuerURL: OIDC issuer URL for JWKS discovery Optional options: - WithCustomJ

WithExclusionUrls configures URL patterns to exclude from JWT validation. URLs can be full URLs or just paths.

WithIssuersResolver sets a dynamic issuer resolution function for token validation. This option allows issuers to be determined at request time based

setupTestDatabase replaces the global tenantDatabase for testing

AuthHeaderTokenExtractor is a TokenExtractor that takes a request and extracts the token and scheme from the Authorization header. Supports both "Bear

CheckToken validates a JWT token string and returns the validated claims. This is the core validation logic that is framework-agnostic: - If token is

GetAuthScheme retrieves the authorization scheme from the context. Returns AuthSchemeUnknown if no scheme was set. Example usage: scheme := core.Ge

MetadataTokenExtractor extracts JWT from the "authorization" metadata key. It supports the "Bearer <token>" format (standard for gRPC). gRPC normaliz

SetDPoPMode stores the DPoP mode in the context. This is used by adapters to track the DPoP mode configuration for error handling.

setupTestServer creates a test HTTP server that returns the specified response code and body.

HasClaims checks if claims exist in the context. Example: if jwtgrpc.HasClaims(ctx) { claims, _ := jwtgrpc.GetClaims[*validator.ValidatedClaim

buildTestToken generates a valid JWT for testing using jwx/v3

setupTestServer creates a test gRPC server with JWT authentication

GetDPoPMode retrieves the DPoP mode from the context. Returns DPoPAllowed if no mode was set (default). Example usage: mode := core.GetDPoPMode(ctx

WithDPoPHeaderExtractor sets a custom DPoP header extractor. Optional - defaults to extracting from the "DPoP" HTTP header per RFC 9449. Use this for

WithDPoPMode sets the DPoP operational mode. Modes: - core.DPoPAllowed (default): Accept both Bearer and DPoP tokens - core.DPoPRequired: Only accept

WithIssuers sets multiple expected issuer claims (iss) for token validation. This is a required option (use either WithIssuer, WithIssuers, or WithIss

WithLogger sets an optional logger for the interceptor. The logger will be used throughout the validation flow in both interceptor and core. The logg

logDebug logs a debug message if the logger is configured.

sendRequest sends a GET request to the test server with an optional Bearer token.

setupTestRedis creates a test Redis client and clears it

validateIssuerWithResolver checks if the token issuer is valid using either the static expectedIssuers list or the dynamic issuersResolver function. T

GetDPoPContext retrieves DPoP context from the context. Returns nil if no DPoP context exists (e.g., for Bearer tokens). Example usage: dpopCtx :=

SetDPoPContext stores DPoP context in the context. This is a helper function for adapters to set DPoP context after validation. DPoP context contains

StreamServerInterceptor returns a grpc.StreamServerInterceptor that validates JWTs. It extracts the JWT from gRPC metadata, validates it, and makes th

WithAlgorithms sets multiple signature algorithms that tokens may use. This is useful for mixed-algorithm MCD (Multiple Custom Domains) scenarios wher

WithCredentialsOptional sets whether credentials are optional. If set to true, an empty token will be considered valid. Default: false (credentials r

WithCredentialsOptional configures whether credentials are optional. When set to true, requests without tokens will be allowed to proceed without val

WithMaxProviders sets the maximum number of issuer providers to cache in memory. When the limit is reached, the least-recently-used provider will be e

WithTrustedProxies configures trusted proxy headers for URL reconstruction. Required when behind reverse proxies to correctly validate DPoP HTU claim.