KeyFunc adheres to the keyFunc signature that the Validator requires. While it returns an interface to adhere to keyFunc, as long as the error is nil

MustGetClaims retrieves claims from the context or panics. Use only when you are certain claims exist (e.g., after middleware has run). Example: cl

MustGetClaims retrieves claims from the context or panics. SAFETY: Only use this function when you are certain claims exist in the context: - After t

Sends a greeting (requires authentication)

SayHello returns a greeting. Requires authentication.

TestAuthHeaderTokenExtractorWithScheme tests the scheme-aware token extractor

Test AuthHeaderTokenExtractor with DPoP scheme

TestAuthHeaderTokenExtractor_MultipleHeaders tests the security feature for multiple Authorization headers

TestCacheControlBackgroundRefresh tests that background refresh respects the new Cache-Control logic

TestCacheControlSecurity tests the security behavior: uses SHORTER of Cache-Control vs configured TTL

TestCheckJWT_WithLogging tests middleware with logging enabled to cover log branches

Test Bearer token scenarios

Test DPoP token scenarios

TestCheckTokenWithDPoP_EdgeCases tests additional edge cases

TestCheckTokenWithDPoP_LoggingPaths tests logging branches for better coverage

============================================================================= RFC 9449 Section 7.1 Compliance Tests ==================================

============================================================================= RFC 9449 Section 7.2 Compliance Tests ==================================

Test with logger to cover logger code paths

TestContextIsolation tests that context values are properly isolated

TestConvertAuthScheme tests the convertAuthScheme function

TestCookieTokenExtractor_EdgeCases tests edge cases for cookie extractor

Bearer + valid_dpop_token → 200 OK (DPoP-bound tokens work as Bearer)

Bearer + valid_dpop_token + valid_proof → 200 OK (DPoP ignored)

Bearer invalid token with proof → 401 invalid_token

Bearer + valid_bearer_token + DPoP header → 200 OK (DPoP header ignored)

DPoP invalid token with proof (rejected) → 400 invalid_request

DPoP + valid_dpop_token → 400 invalid_request

DPoP token with invalid proof (rejected) → 400 invalid_request

============================================================================= Additional RFC 9449 Compliance Tests - DISABLED Mode ===================

Bearer + invalid_token → 401 invalid_token

Malformed "DPoP dpop <valid_dpop_token>" → 400 invalid_request

(no Authorization) + valid_proof → 400 invalid_request

Random scheme (rejected) → 400 invalid_request

unsupported_scheme foo → 400 invalid_request