TsgcHTTP_JWT_Server › Properties › JWTOptions

JWTOptions Property

Server-side validator configuration: enabled signing algorithms (HS/RS/ES) with their Secret or PublicKey, plus registered-claim validations (iat, nbf, exp) and the clock skew allowed.

Syntax

property JWTOptions: TsgcHTTP_JWT_Server_Options read FJWTOptions write SetJWTOptions;

Default Value

All three algorithm families enabled (HS.Enabled, RS.Enabled, ES.Enabled = True); HS.Secret empty, RS.PublicKey and ES.PublicKey empty; Validations.Expiration, Validations.Issued, Validations.NotBefore = True; Validations.Leeway = 60.

Remarks

Mirror of TsgcHTTP_JWT_Client.JWTOptions from the validator perspective — instead of signing material, it holds the verification material and the checks to apply to an incoming token. Sub-objects:

• Algorithms – selects which families of signing algorithms the server will accept. Each family has an Enabled flag; setting Enabled = False causes tokens with that alg header to be rejected with "[family] Algorithm not supported".
  • HS.Secret – shared secret used to verify HS256/384/512 signatures.
  • RS.PublicKey – PEM-encoded RSA public key (TStringList) used to verify RS256/384/512 signatures.
  • ES.PublicKey – PEM-encoded ECDSA public key (TStringList) used to verify ES256/384/512 signatures.
• Validations – registered-claim checks run after the signature verifies. Earlier versions only verified the signature, so an expired token was accepted. A claim which is not present in the Payload is not asserted by the issuer and is not validated.
  • Expiration – reject the token when exp is in the past. Defaults to True, Validations.Expiration := False disables the expiry check.
  • Issued – reject the token when iat is in the future. Defaults to True.
  • NotBefore – reject the token when nbf is in the future. Defaults to True.
  • Leeway – seconds of clock skew allowed when exp, nbf and iat are compared with the current time. Defaults to 60, set it to zero to compare the claims with no allowance.

Issuer, Audience and any other custom claims are not validated automatically; subscribe to OnJWTAfterValidateToken to inspect the decoded Payload and flip the Valid flag based on your own business rules.

Example

// Accept only RS256 tokens signed by a known authority
oJWT.JWTOptions.Algorithms.HS.Enabled := False;
oJWT.JWTOptions.Algorithms.ES.Enabled := False;
oJWT.JWTOptions.Algorithms.RS.Enabled := True;
oJWT.JWTOptions.Algorithms.RS.PublicKey.Text :=
  '-----BEGIN PUBLIC KEY-----' + sLineBreak +
  'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...' + sLineBreak +
  '-----END PUBLIC KEY-----';

// Standard claim checks
oJWT.JWTOptions.Validations.Expiration := True;
oJWT.JWTOptions.Validations.Issued := True;
oJWT.JWTOptions.Validations.NotBefore := True;
// Allow 60 seconds of clock skew between this server and the issuer
oJWT.JWTOptions.Validations.Leeway := 60;

Back to Properties