11 / EDGE
jwt
base64url plus compact-JWT signing and verification under HS256: jwt_sign / jwt_verify check the signature in constant time and enforce exp/nbf, rejecting the alg:none downgrade.
WHERE IT SITS
INTERFACE
fn jwt_sign( claims : Map[String, Json], secret : String, typ~ : String? = Some("JWT"), extra? : Map[String, Json], wins? : @moonknob.Wins, clash? : @moonknob.OnClash[Map[String, Json]]) -> StringfnSign a claims set as a compact HS256 JWT). claims is the payload; put exp/iat/nbf/sub in it as ordinary entries. typ is the header's type ("JWT" unless given; None writes no typ header at all), and extra merges further members into the header. Configuration has three layers, later ones winning: the library preset < the typ given here < extra. wins turns the last two around and clash decides what a collision does: by default the header fields we write are the ones that stand, and giving one a different value in extra` aborts. Both are moonknob's, as in every library of the family.
fn jwt_verify( token : String, secret : String, now_secs : Int64, policy~ : @jwt.Policy = @jwt.policy) -> Map[String, Json] raise @jwt.RefusedfnVerify a compact HS256 JWT and return its claims. now_secs is the verification time as a Unix timestamp in **seconds**, the unit JWT's NumericDate uses — not the milliseconds the [Clock] seam carries, because the claim is defined in seconds. policy carries every check: exp and nbf are verified by default and iat is not, which is what PyJWT and jjwt both do. Hand it a different Policy to require an issuer, an audience, or particular claims.