HALOWERK: Verify a JWT signature and claims, and name the classic token attacks explicitly
jwt_verifyVerify a JWT signature and claims, detecting classic token attacks including alg none, HMAC key confusion, unlimited lifetime, and missing audience.
Instructions
Verify a JWT signature and claims, and name the classic token attacks explicitly: alg none, HMAC confusion, unbounded lifetime, missing audience.
Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf.
Decodes a JWT and checks it in two layers. Structure and claims: expiry, not-before and issued-at against the current time with the clock skew you allow, issuer and audience against the values you expect, and the token lifetime. Signature: HMAC with a shared secret, or RSA, RSA-PSS and ECDSA against a PEM key or a JWKS you point at, with the kid matched to the right key. On top of that it names the attacks that live in this exact spot: alg set to none, an HMAC algorithm where an asymmetric key is expected which is the classic key-confusion path, a token with no expiry at all, and an audience that does not name you. Without a key or secret the token is decoded and its claims judged, and the signature is reported as unverified rather than assumed good. Preis 0.002 USDC je Aufruf, Abrechnung über x402.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| token | Yes | The JWT in compact form. | |
| secret | No | Shared secret for HS256/384/512. | |
| jwks_url | No | JWKS endpoint; the key is picked by kid. | |
| public_key_pem | No | PEM public key for RS/PS/ES algorithms. | |
| expected_issuer | No | Issuer the token must carry. | |
| expected_audience | No | Audience the token must name. | |
| clock_skew_seconds | No | Tolerance for exp and nbf. | |
| max_lifetime_seconds | No | Flag tokens valid for longer than this. |