javalin-security API

0.2.0

javalin-security-jwt/io.github.mzlnk.javalin.security.jwt/JwtConfig

JwtConfig

class JwtConfig

Configuration for the jwt strategy factory.

Configures JWT bearer-token authentication. decoder and keySource are required; other settings have defaults. Leave identityMapper unset to get the default Jwt identity, or set it to map verified tokens to your own domain identity. Roles always come from rolesMapper and land on io.github.mzlnk.javalin.security.authentication.Authentication.roles. Builds a JwtVerification and JwtAuthenticator for the returned strategy, and selects a BearerChallengeUnauthorizedHandler when bearerChallenge is true. Does not configure authorization rules — set those via security.rules.

Properties

var audiences: Set<String>

When non-empty, requires the token's aud claim to contain at least one of these values.

bearerChallenge

var bearerChallenge: Boolean

When true, failed or absent authentication includes a WWW-Authenticate: Bearer header with the 401 response.

clockSkewSeconds

var clockSkewSeconds: Int

Maximum acceptable clock skew in seconds for exp and nbf validation.

var decoder: JwtDecoder?

The JwtDecoder used to verify and decode bearer tokens. Required.

forbiddenHandler

var forbiddenHandler: ForbiddenHandler

Handler for access denied to an authenticated caller.

var identityMapper: JwtIdentityMapper?

Maps a verified DecodedJwt to your own io.github.mzlnk.javalin.security.authentication.Identity, replacing the default Jwt wrapper.

var issuer: String?

When set, requires the token's iss claim to match this value.

var keySource: JwtKeySource?

Where verification keys come from (local public key, PEM, HMAC secret, or JWKS). Required.

var realm: String

Realm attribute included in the WWW-Authenticate header when bearerChallenge is true.

var rolesMapper: JwtRolesMapper

Maps a verified DecodedJwt to the caller's io.javalin.security.RouteRoles.

var tokenResolver: TokenResolver

Locates the raw token in the incoming request.