Module jwe_decrypt 

JWE decryption plugin (jwe-decrypt).

Reads a JWE-encrypted token from a request header, decrypts it, and forwards the plaintext into another request header before the request is proxied upstream. This is a faithful subset of APISIX’s jwe-decrypt plugin: it implements the dir (direct) key-management algorithm with A256GCM content encryption only — the exact scheme APISIX supports via its resty.aes 256-bit GCM cipher. Other JWE algorithms (RSA-OAEP, ECDH-ES, key-wrap variants, other content ciphers) are not supported; see the Deviations section of the docs page.

The symmetric key is either configured inline (key, base64) or resolved per request from the consumer store (use_consumers) using the kid carried in the JWE protected header. Malformed tokens and decryption failures are rejected with a 401 (JWE_INVALID) routed through the error port.

Structs

JweDecryptPlugin

Decrypts a JWE dir+A256GCM token and forwards the plaintext downstream.

Constants

AUTH_TYPE 🔒

The consumer-store auth type under which jwe-decrypt credentials are indexed.

Functions

aes256gcm_decrypt 🔒

AES-256-GCM decryption for the dir+A256GCM JWE scheme. aad is the ASCII bytes of the base64url-encoded protected header (RFC 7516 §5.1).

b64url_decode 🔒

Decodes a base64url (RFC 4648 §5, no padding) string, tolerating any trailing = padding some encoders emit.

decode_config_key 🔒

Decodes a configured/consumer key that may be either standard or url-safe base64 (with or without padding).