JWT issuer

This module provides support for issuing (JWT) tokens to clients. It must be used together with an authentication module.

The module implements parts of RFC7519, and the algorithm currently supported is HMAC SHA-256 (“HS256”).

The secrets are stored on the server side in plain text. Please ensure that the configuration files have appropriate permissions.

Example configuration

{
    "name": "example",
    "host": "example.com",
    "path": "/*",
    "modules": [
        {
            "order": 0,
            "name": "auth-apikey",
            "consumers": {
                "foo": {
                    "secret": "somekey"
                }
            }
        },
        {
            "order": 1,
            "name": "session-jwt-issuer",
            "consumers": {
                "foo": {
                    "issuer": "someissuer",
                    "secret": "somesecret"
                }
            }
        }
    ]
}

Consumer configuration attributes

Attribute	Required	Type	Default	Description
`secret`	Yes	String		The secret key used to sign the token.
`issuer`	No	String		Will be added to the token as the issuer (iss) claim.

Response status

Status	Description
`200`	The request was authorized to access the specified resource.
`403`	Forbidden.

Response headers

Header	Description
`X-Session-Token`	The generated (JWT) token.
`X-Session-Type`	The session type used, will with this module be `jwt`.

The JWT module will not return detailed information to the client about why a request was rejected. This information can be found in the logs.