TsgcHTTP_JWT_Server › Properties › JWTOptions

JWTOptions Property

Server-side validator configuration: enabled signing algorithms (HS/RS/ES/ML-DSA) with their Secret or PublicKey, plus registered-claim validations (iat, nbf, exp) and the clock skew allowed.

Syntax

property JWTOptions: TsgcHTTP_JWT_Server_Options read FJWTOptions write SetJWTOptions;

Default Value

All four algorithm families enabled (HS.Enabled, RS.Enabled, ES.Enabled, MLDSA.Enabled = True); HS.Secret empty, RS.PublicKey, ES.PublicKey and MLDSA.PublicKey empty; Validations.Expiration, Validations.Issued, Validations.NotBefore = True; Validations.Leeway = 60.

Remarks

Mirror of TsgcHTTP_JWT_Client.JWTOptions from the validator perspective — instead of signing material, it holds the verification material and the checks to apply to an incoming token. Sub-objects:

• Algorithms – selects which families of signing algorithms the server will accept. Each family has an Enabled flag; setting Enabled = False causes tokens with that alg header to be rejected with "[family] Algorithm not supported".
  • HS.Secret – shared secret used to verify HS256/384/512 signatures.
  • RS.PublicKey – PEM-encoded RSA public key (TStringList) used to verify RS256/384/512 signatures.
  • ES.PublicKey – PEM-encoded ECDSA public key (TStringList) used to verify ES256/384/512 signatures.
  • MLDSA.PublicKey, a SubjectPublicKeyInfo PEM public key (TStringList) used to verify the post-quantum ML-DSA-44/65/87 signatures of RFC 9964. The parameter set of the key must be the one the alg header names, a token signed with any other is rejected. Setting MLDSA.Enabled = False rejects every ML-DSA token with "ML-DSA Algorithm not supported".
• Validations – registered-claim checks run after the signature verifies. Earlier versions only verified the signature, so an expired token was accepted. A claim which is not present in the Payload is not asserted by the issuer and is not validated.
  • Expiration – reject the token when exp is in the past. Defaults to True, Validations.Expiration := False disables the expiry check.
  • Issued – reject the token when iat is in the future. Defaults to True.
  • NotBefore – reject the token when nbf is in the future. Defaults to True.
  • Leeway – seconds of clock skew allowed when exp, nbf and iat are compared with the current time. Defaults to 60, set it to zero to compare the claims with no allowance.

Verifying an ML-DSA signature is pure Object Pascal from the sgcCrypto pack, so it needs no OpenSSL library. In a build without that pack the MLDSA options still exist, so a form stored with them still loads, but every ML-DSA token is rejected with "ML-DSA Algorithm not supported, it needs the sgcCrypto pack". See JWT for the algorithms themselves.

Issuer, Audience and any other custom claims are not validated automatically; subscribe to OnJWTAfterValidateToken to inspect the decoded Payload and flip the Valid flag based on your own business rules.

Example

// Accept only RS256 tokens signed by a known authority
oJWT.JWTOptions.Algorithms.HS.Enabled := False;
oJWT.JWTOptions.Algorithms.ES.Enabled := False;
oJWT.JWTOptions.Algorithms.RS.Enabled := True;
oJWT.JWTOptions.Algorithms.RS.PublicKey.Text :=
  '-----BEGIN PUBLIC KEY-----' + sLineBreak +
  'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...' + sLineBreak +
  '-----END PUBLIC KEY-----';

// Standard claim checks
oJWT.JWTOptions.Validations.Expiration := True;
oJWT.JWTOptions.Validations.Issued := True;
oJWT.JWTOptions.Validations.NotBefore := True;
// Allow 60 seconds of clock skew between this server and the issuer
oJWT.JWTOptions.Validations.Leeway := 60;

// Accept only post-quantum ML-DSA tokens
oJWT.JWTOptions.Algorithms.HS.Enabled := False;
oJWT.JWTOptions.Algorithms.RS.Enabled := False;
oJWT.JWTOptions.Algorithms.ES.Enabled := False;
oJWT.JWTOptions.Algorithms.MLDSA.Enabled := True;
oJWT.JWTOptions.Algorithms.MLDSA.PublicKey.Text :=
  '-----BEGIN PUBLIC KEY-----' + sLineBreak +
  'MIIFMjALBglghkgBZQMEAxIDggUhAA...' + sLineBreak +
  '-----END PUBLIC KEY-----';

Back to Properties