Class JwtValidator

Namespace

Shard.Network.Auth

Assembly

Shard.Network.Auth.dll

Validates EdDSA (Ed25519) JWTs against the service JWKS. The BCL has no Ed25519, so signatures are verified with NSec. JWKS is fetched on demand and cached, refreshed on a key-id miss (key rotation). Claims (iss/aud/exp/nbf/sub/username/scope) are read with a reflection-free DOM.

public sealed class JwtValidator

Inheritance

object

JwtValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

JwtValidator(ServiceHttpClient, AuthConfig)

Validates EdDSA (Ed25519) JWTs against the service JWKS. The BCL has no Ed25519, so signatures are verified with NSec. JWKS is fetched on demand and cached, refreshed on a key-id miss (key rotation). Claims (iss/aud/exp/nbf/sub/username/scope) are read with a reflection-free DOM.

public JwtValidator(ServiceHttpClient http, AuthConfig config)

Parameters

http ServiceHttpClient

config AuthConfig

Methods

ValidateAsync(string, string?, CancellationToken)

Validate an identity token; throws on any failure, returns the claims on success.

public Task<JwtClaims> ValidateAsync(string token, string? expectedAudience = null, CancellationToken ct = default)

Parameters

token string

expectedAudience string

ct CancellationToken

Returns

Task<JwtClaims>