docs/jwt/decrypt/interfaces/JWTDecryptOptions.md
Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by becoming a sponsor.
Combination of JWE Decryption options and JWT Claims Set verification options.
ā¢ optional audience?: string | string[]
Expected JWT "aud" (Audience) Claim value(s). This option makes the JWT "aud" (Audience) Claim presence required.
ā¢ optional clockTolerance?: string | number
Clock skew tolerance in seconds when a number (e.g. 5), or resolved into seconds when a string
(e.g. "5 seconds", "10 minutes", "2 hours"). Used when validating the JWT "nbf" (Not Before)
and "exp" (Expiration Time) claims, and when validating the "iat" (Issued At) claim if the
maxTokenAge option is set.
ā¢ optional contentEncryptionAlgorithms?: string[]
A list of accepted JWE "enc" (Encryption Algorithm) Header Parameter values. By default all "enc" (Encryption Algorithm) values applicable for the used key/secret are allowed.
ā¢ optional crit?: object
An object with keys representing recognized "crit" (Critical) Header Parameter names. The value
for those is either true or false. true when the Header Parameter MUST be integrity
protected, false when it's irrelevant. The JWS extension Header Parameter b64 is always
recognized and processed properly; no other registered Header Parameters currently receive this
built-in treatment.
[!WARNING]
This only checks that the Header Parameter is syntactically correct when provided and, optionally, integrity protected. It does not process the Header Parameter or reject the operation when it is missing. You MUST still verify its presence and process it according to the profile's validation steps after the operation succeeds.
[propName: string]: boolean
ā¢ optional currentDate?: Date
Date to use when comparing NumericDate claims, defaults to new Date().
ā¢ optional issuer?: string | string[]
Expected JWT "iss" (Issuer) Claim value(s). This option makes the JWT "iss" (Issuer) Claim presence required.
ā¢ optional keyManagementAlgorithms?: string[]
A list of accepted JWE "alg" (Algorithm) Header Parameter values. By default all "alg" (Algorithm) Header Parameter values applicable for the used key/secret are allowed except for all PBES2 Key Management Algorithms, these need to be explicitly allowed using this option.
ā¢ optional maxDecompressedLength?: number
Maximum allowed size (in bytes) of the decompressed plaintext when the JWE "zip" (Compression
Algorithm) Header Parameter is present. By default this value is set to 250000 (250 KB). The
value must be 0, a positive safe integer, or Infinity. Set it to 0 to reject all
compressed JWEs during decryption or to Infinity to disable the decompressed size limit.
ā¢ optional maxPBES2Count?: number
(PBES2 Key Management Algorithms only) Maximum allowed "p2c" (PBES2 Count) Header Parameter value. The PBKDF2 iteration count defines the algorithm's computational expense. By default this value is set to 10000.
ā¢ optional maxTokenAge?: string | number
Maximum time elapsed from the JWT "iat" (Issued At) Claim value, in seconds when a number (e.g. 5), or resolved into seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours"). This option makes the JWT "iat" (Issued At) Claim presence required.
ā¢ optional requiredClaims?: string[]
Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
the issuer option is set, then JWT "iss" (Issuer) Claim must be present; if the
audience option is set, then JWT "aud" (Audience) Claim must be present; if
the subject option is set, then JWT "sub" (Subject) Claim must be present; if
the maxTokenAge option is set, then JWT "iat" (Issued At) Claim must be
present.
ā¢ optional subject?: string
Expected JWT "sub" (Subject) Claim value. This option makes the JWT "sub" (Subject) Claim presence required.
ā¢ optional typ?: string
Expected JWT "typ" (Type) Header Parameter value. This option makes the JWT "typ" (Type) Header Parameter presence required.