JWTAuth

JWTAuth validates Bearer JSON Web Tokens using JWKS, an OIDC issuer, or a static public key, and produces a principal on success.

JWTAuth is defined in the policy schema but is not executed by the policy engine yet.

Fields

string

URL of the JWKS endpoint for token verification.

string

OIDC issuer URL. Frontline discovers the JWKS URI from the issuer’s .well-known/openid-configuration.

bytes

PEM-encoded public key for token verification. Use this for static key pairs.

string

Required iss claim value.

string[]

Allowed aud claim values.

string[]

Allowed signing algorithms.

string

Claim used as the principal subject. Defaults to sub.

bool

When true, requests without a token are allowed through without setting a principal.

int64

Tolerance for time-based claim validation (exp, nbf, iat), in milliseconds.

int64

How long to cache the JWKS response, in milliseconds.

Examples

OIDC issuer
JWKS URI
Optional auth

{
  "policies": [
    {
      "id": "jwt-auth",
      "name": "Validate JWTs via OIDC",
      "enabled": true,
      "match": [],
      "jwtauth": {
        "oidc_issuer": "https://auth.example.com",
        "audiences": ["api.example.com"],
        "algorithms": ["RS256"]
      }
    }
  ]
}

{
  "policies": [
    {
      "id": "jwt-auth",
      "name": "Validate JWTs via JWKS",
      "enabled": true,
      "match": [],
      "jwtauth": {
        "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
        "issuer": "https://auth.example.com",
        "audiences": ["api.example.com"],
        "algorithms": ["RS256"],
        "jwks_cache_ms": 3600000
      }
    }
  ]
}

{
  "policies": [
    {
      "id": "jwt-auth-optional",
      "name": "Optional JWT auth",
      "enabled": true,
      "match": [],
      "jwtauth": {
        "oidc_issuer": "https://auth.example.com",
        "audiences": ["api.example.com"],
        "allow_anonymous": true
      }
    }
  ]
}

Requests without a token pass through without a Principal. Requests with an invalid token are rejected.

Overview

Services

RFCs

Fields

Examples

​Fields

​Examples

Fields

Examples