JWT๏
Inherits: Object
Singleton for JSON Web Token (JWT) encoding, decoding, validation, and cryptographic operations.
Description๏
The JWT singleton provides a toolkit for Godot to handle RFC-7519 JSON Web Tokens. It supports encoding, decoding, and validation of JWTs using RS256 and HS256 algorithms. It also provides functionality for key rotation, and token revocation via JTIs.
var builder = JWTBuilder.new().set_algorithm('HS256').add_claim('user', 'admin')
var token = builder.sign('secret')
print(JWT.parse(token).get_claim_as_string('user'))
Methods๏
Method Descriptions๏
String base64url_decode(b64url: String) ๐
Decodes a Base64Url-encoded string into a standard String.
String base64url_encode(str: String) ๐
Encodes a String into a Base64Url-encoded string.
void clear_revoked() ๐
Clears all revoked JTIs from the internal blacklist cache.
String create_jwt(header: Dictionary, payload: Dictionary, key: Variant) ๐
Creates a JWT from a header and payload dictionary. The key type depends on the algorithm.
String create_jwt_hs256(header: Dictionary, payload: Dictionary, secret: String) ๐
Creates a JWT signed with HMAC SHA-256 (HS256) using a given secret string.
String create_jwt_rs256(header: Dictionary, payload: Dictionary, key: CryptoKey) ๐
Creates a JWT signed with RSA (RS256) using a CryptoKey.
String create_jwt_timed(header: Dictionary, payload: Dictionary, key: Variant, validity_seconds: float) ๐
Deprecated. Prefer using JWTBuilder with JWTBuilder.set_expiration() instead.
Dictionary decode(jwt: String) ๐
Decodes the JWT payload into a dictionary without validating the signature. Do not use for authentication.
String get_algorithm(jwt: String) ๐
Extracts the algorithm (alg) from the unverified JWT header.
Variant get_claim(jwt: String, claim: String) ๐
Extracts a specific claim from the unverified JWT payload.
Dictionary get_header(jwt: String) ๐
Decodes and returns the JWT header as a dictionary without validating the signature.
String get_kid(jwt: String) ๐
Extracts the Key ID (kid) from the unverified JWT header.
Dictionary get_payload(jwt: String) ๐
Decodes and returns the JWT payload as a dictionary without validating the signature.
String get_signature(jwt: String) ๐
Extracts the signature portion of the JWT.
bool has_claim(jwt: String, claim: String) ๐
Returns true if the unverified JWT payload contains the specified claim.
bool is_expired(jwt: String) ๐
Checks whether the JWT is expired based on its exp claim. Does not validate the signature.
bool is_revoked(jti: String) const ๐
Checks whether the specified JTI has been explicitly revoked in the internal blacklist.
DecodedJWT parse(jwt: String) ๐
Parses an encoded JWT string and returns a DecodedJWT object for easier inspection. Does not validate the signature.
void revoke_jti(jti: String) ๐
Adds a JTI claim to the internal blacklist. Any future validation of tokens containing this JTI will fail.
bool validate(jwt: String, key: Variant) ๐
Validates the JWT's signature against the provided key. The key must be a String for HS256 or a CryptoKey for RS256.
bool validate_any(jwt: String, keys: Array) ๐
Validates the JWT's signature against an array of keys. It returns true if any key correctly validates the token.
bool validate_claims(jwt: String, expected_claims: Dictionary) ๐
Validates that the JWT payload contains the exact claims specified in the expected_claims dictionary.
PackedStringArray validate_claims_diagnostic(jwt: String, expected_claims: Dictionary) ๐
Validates claims against the expected_claims dictionary and returns an array of keys that failed validation.
Dictionary validate_diagnostic(jwt: String, key: Variant) ๐
Evaluates the JWT signature and structural validity, returning a dictionary detailing valid, error, and internal constraints.
bool validate_header_claims(jwt: String, expected_claims: Dictionary) ๐
Validates that the JWT header contains the exact claims specified in the expected_claims dictionary.
bool validate_signature_hs256(jwt: String, secret: String) ๐
Validates an HS256 JWT signature using the explicit string secret.
bool validate_signature_rs256(jwt: String, key: CryptoKey) ๐
Validates an RS256 JWT signature using the provided CryptoKey.
bool validate_timing(jwt: String, leeway_seconds: float = 0.0) ๐
Validates the exp (expiration) and nbf (not before) claims against the current time, with an optional clock leeway in seconds.
bool validate_with_map(jwt: String, key_map: Dictionary) ๐
Validates the JWT using a map of keys. It automatically selects the correct key from the key_map dictionary based on the token's kid header.