JwtClaimsPolicy

JwtClaimsPolicy

Claims policy for verifyJwt. Application authorization stays with the caller.

interface JwtClaimsPolicy {
	readonly issuer: string | readonly string[] | Unchecked;
	readonly audience: string | readonly string[] | Unchecked;
	readonly requiredClaims?: readonly string[];
	readonly now?: () => Date;
	readonly clockToleranceSeconds?: number;
	readonly maxAgeSeconds?: number;
	readonly futureIssuedAt?: FutureIssuedAtPolicy;
}

Properties

• readonly issuer: string | readonly string``[] | Unchecked — Accepted iss values (any one may match), or { unchecked: true }.
• readonly audience: string | readonly string``[] | Unchecked — Accepted aud values (any one may match), or { unchecked: true }.
• readonly requiredClaims?: readonly string``[] — Claims that must be present. Default ['exp'].
• readonly now?: () => Date — The clock. Default is the system time.
• readonly clockToleranceSeconds?: number — Leeway in seconds for exp, nbf and iat, from 0 to 600. Default 0.
• readonly maxAgeSeconds?: number — Oldest acceptable token age in seconds, measured from iat. Requires iat.
• readonly futureIssuedAt?: FutureIssuedAtPolicy — Whether iat after the clock is accepted. Default 'reject'.