mb-jwt
JWT (JSON Web Tokens) for MoonBit with HS256 signing and verification
crypto
jwt
token
hs256
json-web-token
moon add Tigls/mb-jwt@0.1.0
Download zipAuthor
Version
0.1.0
License
Apache-2.0
Repository
Last updated
4 months ago
Downloads
23
Dependencies
- Tigls/mb-hmac0.1.0
README#mb-jwt
JWT (JSON Web Tokens) implementation for MoonBit with HS256 signing.
#Status
In Development - Implements HS256 algorithm (HMAC-SHA256).
#Installation
Add to your moon.mod.json:
{
"deps": {
"moon-crypto/mb-jwt": "0.1.0"
}
}#Usage
#Sign a token
let payload = "{\"sub\":\"1234567890\",\"name\":\"John Doe\"}"
let secret = "your-secret-key"
let token = @jwt.sign(payload, secret)
// Returns: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOi...#Verify a token
match @jwt.verify(token, secret) {
Ok(payload) => println("Valid! Payload: " + payload)
Err(e) => println("Invalid: " + e)
}#Decode without verification
// WARNING: Never trust unverified tokens
match @jwt.decode(token) {
Ok(payload) => println(payload)
Err(e) => println("Malformed token")
}#API
| Function | Description |
|---|---|
| sign(payload: String, secret: String) -> String | Create a signed JWT |
| verify(token: String, secret: String) -> Result[String, String] | Verify and decode a JWT |
| decode(token: String) -> Result[String, String] | Decode without verification |
| decode_header(token: String) -> Result[String, String] | Decode the JWT header |
#Supported Algorithms
- HS256 - HMAC with SHA-256 (default, currently only supported)
#Security Notes
- Uses constant-time comparison for signature verification
- Always verify tokens before trusting their contents
- Use strong, random secrets (at least 256 bits)
#Dependencies
- mb-hmac - HMAC-SHA256 implementation
#decode
fn decode(token : String) -> Result[String, String]Decodes a JWT token without verifying the signature.
Use this only when you need to inspect the payload without verification.
WARNING: Never trust the contents of an unverified token.
#decode_header
fn decode_header(token : String) -> Result[String, String]Decodes the header of a JWT token without verification.
#sign
fn sign(payload : String, secret : String) -> StringSigns a JSON payload and returns a JWT token string.
The payload should be a valid JSON string.
Example:
let token = sign("{\"sub\":\"1234567890\",\"name\":\"John\"}", "secret")#verify
fn verify(token : String, secret : String) -> Result[String, String]Verifies a JWT token and returns the decoded payload if valid.
Returns an error if the signature is invalid or the token is malformed.
Source Files
JWT (JSON Web Tokens) for MoonBit with HS256 signing and verification
cryptojwttokenhs256json-web-token
0.1.0
Apache-2.0
Updated 4 months ago
23 downloadsDependencies
- Tigls/mb-hmac0.1.0