Documentation

Documentation / @zerotal/auth / Jwt

Variable: Jwt

const Jwt: object

Defined in: auth/src/Jwt.ts:49

Type Declaration

sign()

sign(payload, secret, options?): string

Sign a payload into a compact HS256 JWT. A numeric iat is always added; an exp is added when expiresIn is given.

Parameters

payload

JwtPayload

Claims to embed. iat (and exp, if expiresIn is set) are added/overwritten by this method.

secret

string

The HMAC secret; the same value must be supplied to verify.

options?

JwtSignOptions = {}

Optional expiresIn (seconds) and issuedAt (unix seconds) override.

Returns

string

The compact header.body.signature token string.

verify()

verify<T>(token, secret): T | null

Verify a token's algorithm, signature, and expiry, returning its claims, or null when the token is malformed, uses a non-HS256 alg, is tampered, signed with the wrong secret, or expired.

Type Parameters

T

T extends JwtPayload = JwtPayload

The expected claims shape; the result is cast to T on success.

Parameters

token

string

The compact JWT string to verify.

secret

string

The HMAC secret the token was signed with.

Returns

T | null

The decoded claims on success, otherwise null.

Remarks

Never throws — every failure mode (bad structure, unparseable header/body, wrong alg, signature mismatch, elapsed exp) is folded into a null return, so callers only branch on the result. The alg check happens before signature verification to foreclose algorithm-confusion / alg: none attacks.