lacewing - v2.0.1
    Preparing search index...

    Interface ProfileOptions

    Lacewing - an opinionated JWT library where RFC 8725 (JWT Best Current Practices) is the default behavior, not an optional configuration.

    This barrel is the public API. Internals under src/lib/ are policy machinery and stay private; legacy interop algorithms live behind the explicit lacewing/legacy/* imports.

    interface ProfileOptions {
        algorithms: readonly (string | AlgorithmInfo<string>)[];
        audience: string;
        claimValidators?: Record<string, ValidateClaim>;
        issuer: string;
        keys: StaticJWKS | RemoteJWKS | KeySource | LacewingKey;
        maxClockSkew?: string | number;
        maxTokenAge: string | number;
        maxTokenLifetime?: string | number;
        revocation?: RevocationStore;
        subject?: string;
        typ: string;
        unsafeFailOpenOnRevocationError?: boolean;
    }
    Index
    algorithms audience claimValidators? issuer keys maxClockSkew? maxTokenAge maxTokenLifetime? revocation? subject? typ unsafeFailOpenOnRevocationError?
    algorithms: readonly (string | AlgorithmInfo<string>)[]

    Explicit algorithm allowlist - the token header never decides (§3.1). Names from the default set ("EdDSA", "ES256", "PS256", ...), or legacy descriptors from lacewing/legacy/rsa such as LEGACY_RS256; "RS256" as a bare string is refused.

    audience: string

    The audience value that must appear in the token (§3.9).

    claimValidators?: Record<string, ValidateClaim>

    Extra per-claim predicates, run after all standard checks.

    issuer: string

    The one issuer this profile trusts (§3.8).

    keys: StaticJWKS | RemoteJWKS | KeySource | LacewingKey

    Key source: a JWKS (static or remote config), a KeySource, or a single key.

    maxClockSkew?: string | number

    Allowed clock skew, default 5s, capped at 120s.

    maxTokenAge: string | number

    Maximum accepted token age (now - iat), independent of exp.

    maxTokenLifetime?: string | number

    Optional cap on the token's declared lifetime (exp - iat). Where maxTokenAge bounds how long a token stays usable, this refuses a token whose issuer claimed an implausible span at all - a misissuance signal.

    revocation?: RevocationStore

    Optional revocation store - its absence is a visible choice.

    subject?: string

    Pin the expected sub (§3.8.2).

    typ: string

    Expected token type, e.g. "at+jwt" (§3.11).

    unsafeFailOpenOnRevocationError?: boolean

    Ugly on purpose: accept tokens when the revocation store errors (LW-rev.4).

    Settings
    Member Visibility

    On This Page
    Properties