Class: Hanko::WebhookVerifier

Inherits:

Object

• Object
• Hanko::WebhookVerifier

Defined in:

lib/hanko/webhook_verifier.rb

Overview

Verifies Hanko webhook JWT tokens against a remote JWKS endpoint.

Examples:

Verify a webhook token

payload = Hanko::WebhookVerifier.verify(token, jwks_url: "https://example.hanko.io/.well-known/jwks.json")
puts payload["sub"]

Constant Summary

ALGORITHM =

'RS256'

Class Method Summary

• .verify(token, jwks_url:) ⇒ Hash

  Decodes and verifies a JWT token using keys from the given JWKS URL.

Class Method Details

.verify(token, jwks_url:) ⇒ Hash

Decodes and verifies a JWT token using keys from the given JWKS URL.

Parameters:

• token (String) —

  the JWT token to verify

• jwks_url (String) —

  URL of the JWKS endpoint

Returns:

• (Hash) —

  the decoded JWT payload

Raises:

• (ExpiredTokenError) —

  if the token has expired

• (InvalidTokenError) —

  if the token is invalid or cannot be decoded

# File 'lib/hanko/webhook_verifier.rb', line 23

def self.verify(token, jwks_url:)
  jwks = fetch_jwks(jwks_url)
  decoded = JWT.decode(token, nil, true, algorithms: [ALGORITHM], jwks: jwks)
  decoded.first
rescue JWT::ExpiredSignature => e
  raise ExpiredTokenError, e.message
rescue JWT::DecodeError => e
  raise InvalidTokenError, e.message
end