Struct JwtAuthPlugin 

pub struct JwtAuthPlugin {
    secret: Option<String>,
    algorithm: Algorithm,
    header_name: String,
    use_consumers: bool,
    resources: Arc<PluginResources>,
}

Authenticates requests by verifying a JWT signature and expiry (exp).

The token is read from the configured header (with an optional Bearer prefix stripped). On success the plugin writes into context.message:

• "jwt_claims": the full decoded claims object
• "user_id": the sub claim, when present (convenience copy)

In consumer mode the matched consumer’s identity is also attached (consumer.* message keys + X-Consumer-* headers).

On failure the request is rejected with a 401 JSON response and a JWT_INVALID error routed through the error port.

Fields

secret: Option<String>

Shared HMAC secret used to verify token signatures (inline mode). None when only consumer mode is configured.

algorithm: Algorithm

HMAC algorithm the token must be signed with in inline mode.

header_name: String

Lowercased name of the request header carrying the token.

use_consumers: bool

When true, tokens are also resolved against the consumer store via their key claim and verified with the consumer’s own secret.

resources: Arc<PluginResources>

Implementations

impl JwtAuthPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• secret (string, optional): HMAC secret for inline signature verification. When set, every token is verified with it.
• use_consumers (bool, default false): resolve the token’s key claim against the gateway’s consumers: section (jwt-auth: {key, secret, algorithm}) and verify with the matched consumer’s secret/algorithm, attaching the consumer on success.
• At least one of secret / use_consumers must be provided.
• algorithm (string, default "HS256"): one of HS256, HS384, HS512 used for inline verification; any other value is a config error — an auth plugin must not silently verify with a different algorithm than the one requested.
• header_name (string, default "authorization"): header to read the token from (compared case-insensitively via lowercasing).

type: jwt-auth
config:
  use_consumers: true
  header_name: authorization

fn reject( ctx: Context, message: &str, ) -> Result<PluginOutput, PluginExecutionError>

Builds the 401 rejection with a JSON error body and returns a PluginExecutionError (code JWT_INVALID) carrying the context so the graph engine routes through the error port.

fn verify( token: &str, secret: &str, algorithm: Algorithm, ctx: &mut Context, ) -> Result<HashMap<String, Value>, String>

Verifies token with secret/algorithm and, on success, writes the claims into context.message. Returns the decoded claims on success.

fn peek_key_claim(token: &str) -> Option<String>

Reads the key claim from an unverified token payload.

The payload segment is base64url-decoded and parsed as JSON purely to discover which consumer to look up; the signature is verified only afterwards with that consumer’s secret, so no trust is placed in this value.

Trait Implementations

impl Plugin for JwtAuthPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.