Hello,
Introduction
I would like to pitch JWSETKit to the SSWG.
JWSETKit is a library that supports create, sign, decode and verify JWS and JWT objects and encrypt/decrypt using JWE standard.
Motivation
JSON Web Token (JWT) is a compact claims representation format intended for space constrained environments such as HTTP Authorization headers and URI query parameters.
Usage
To create a JWT instance from String or Data,
let jwt = try JSONWebToken(from: authorization)
To assign a JWT to URLRequest's
Authorization header using Foundation/URLRequest/authorizationToken ,
var request = URLRequest(url: URL(string: "https://www.example.com")!)
request.authorizationToken = jwt
To convert back a JWT instance to string representation,
let jwtString = try String(jws: jwt)
or
let jwtString = jwt.description
Accessing Claims
Various claims, including registered and claims defined by OpenID Connect Core
are predefined for JSON Web Token's payload.
Claim names are more descriptive than keys defined by IANA Registry,
for example sub claim became JSONWebTokenClaimsRegisteredParameters/subject
and iat became JSONWebTokenClaimsRegisteredParameters/issuedAt.
For a complete list of predefined claims check JSONWebTokenClaimsRegisteredParameters,
JSONWebTokenClaimsOAuthParameters, JSONWebTokenClaimsPublicOIDCAuthParameters and
JSONWebTokenClaimsPublicOIDCStandardParameters.
For StringORURL types that are common to be a URL, there are two accessors
for String and URL, e.g.
let subjectString = jwt.subject // `sub` claim as String
let subjectURL = jwt.subjectURL // `sub` claim parsed as URL
Date types are converted automatically from Unix Epoch to Swift's Date.
For types that can be either a string or an array of strings, data type is [String],
let singleAudience = jwt.audience.first
Also JSONWebTokenClaimsOAuthParameters/scope items are separated by
space according to standard and a list of items can be accessed
using JSONWebTokenClaimsOAuthParameters/scopes.
Verify Signature
To verify the signature(s), first create public key(s)] then use
verifySignature(using:) to verify signature(s).
If an array of keys is passed to verifySignature(using:) the most appropriate
key will be selected according alg value and then kid value if multiple keys
are candidates regarding JOSEHeader counterpart of signature.
Using symmetric key for HS256, etc.,
let hmacKey = SymmetricKey(data: hmacKeyData)
do {
try jwt.verifySignature(using: hmacKey)
} catch {
print("signature is invalid.")
}