Package: py-jwt-validator
py-jwt-validatorRealease notesVersionRelease notes1.0.0MAJOR Release.Added support for Google, Microsoft and Auth0.0.5.0MAJOR Release.Production stable. Added cache control.0.4.0-betaSecurity fix. Certificate Chain is mandatory for Okta Custom URL Domain.0.3.0-betaMinor release. Added support for Okta Custom URL Domain.0.2.0-betaMinor release. Added support for AWS Cognito JWT.0.1.0-betaMinor release. Increased configurability.0.0.1-betaFirst package release.PyPy:https://pypi.org/project/py-jwt-validator/Supported IdPsOktaAWS CognitoGoogleMicrosoftAuth0Supported Signing AlgorithmsRS256DisclaimerThis library is provded as is. None of the listed IdPs will provide support for issues related with the present library. I am the sole maintainer of it.Process ChainOnce the class is instantiated the following checks are performed:JWT Format.JWT Expiration time.JWT Claims if given when the class was instantiated.Is Algorithm Supported.After the above checks are done, it will verify the token signature with the apropriate signing algorithm based on the "alg" header claim. If the signature is valid, it will returnNone. Else, it will raise a exception.If a check fails at any given step, the exceptionPyJwtExceptionwill be raised.The /.well-knwon/openid-configuration endoint will be compiled based on the 'iss' claim.The /keys endpoint will be determined from the output of the /.well-knwon/openid-configuration endpointThe response from /keys will be cached (requests_cache) for subsequent calls.Installationpip install py-jwt-validatorUsage Examplesfrom py_jwt_validator import PyJwtValidator, PyJwtException
jwt = access_token / id_token
try:
    PyJwtValidator(jwt)
except PyJwtException as e:
    print(f"Exception caught. Error: {e}")Ifauto_verifyis set toFalsethe class will not perform the signature validation. To check the signature theverify()method needs to be used. By default, the method will return None. In order to return the decoded jwt data (header + payload)Truehas to be passed. Example:from py_jwt_validator import PyJwtValidator, PyJwtException
jwt = access_token / id_token
validator = PyJwtValidator(jwt, auto_verify=False)
try:
    payload = validator.verify(True)
    print(payload)
except PyJwtException as e:
    print(f"Exception caught. Error: {e}")Custom Claim Validation:from py_jwt_validator import PyJwtValidator, PyJwtException
jwt = access_token / id_token
validator = PyJwtValidator(jwt, auto_verify=False, custom_claim_name="custom_claim_value")
try:
    payload = validator.verify(True)
    print(payload)
except PyJwtException as e:
    print(f"Exception caught. Error: {e}")Cache Control:redisfrom redis import StrictRedis
from py_jwt_validator import PyJwtValidator, PyJwtException


redis = StrictRedis(host="localhost", port=6390)

jwt = access_token / id_token
validator = PyJwtValidator(jwt, auto_verify=False, cache_store="redis", cache_store_connection=redis)
try:
    payload = validator.verify(True)
    print(payload)
except PyJwtException as e:
    print(f"Exception caught. Error: {e}")pymongofrom pymongo import MongoClient
from py_jwt_validator import PyJwtValidator, PyJwtException


mongo = MongoClient("localhost", 27017)

jwt = access_token / id_token
validator = PyJwtValidator(jwt, auto_verify=False, cache_store="mongo", cache_store_connection=mongo)
try:
    payload = validator.verify(True)
    print(payload)
except PyJwtException as e:
    print(f"Exception caught. Error: {e}")Class AttributesThe classPyJwtValidatorcurrently accepts:AttributeRequiredDefault valuejwtYesNonecid - OIDC Client IDNoNoneaud - AudienceNoNoneiss - IssuerNoNoneauto_verifyNoTruecheck_expiryNoTruecache_enabledNoTruecache_lifetimeNo1 daycache_storeNosqlitecache_store_connectionNoNoneThe class methodverify()currently accepts:AttributeRequiredDefault valueget_payloadNoFalseNoteThe reason why this class returnsNoneor exception is to provide more flexibility. Not everyone needs to return the decoded payload of the jwt.
It is recommended to use it withintry:exceptblocks.Cache ControlThis library relies on therequestsandrequests_cachelibraries. The caching control mechanism was implemented around these libraries.Cache Control attributes explainedcache_enabled - Attribute type: Boolean - Accepted Values: True / False. Determines if the cache control mechanism will be used. If set to False, the response from the /.well-knwon/openid-configuration and /keys endpoints will never be cached.cache_lifetime - Attribute type: Integer - Accepted Values: 1 - 30. Represents the number ofdaysthe cache will be stored and used. The maximum value can not be higher than 30 days or less than 1 day.cache_store - Attribute type: String - Accepted Values: "memory", "sqlite", "mongo", "redis". Determines how and where therequests_cachelibrary will store the responses and connect to the caching store. When there is no cache_store_connection provided, it will rely on the defaults for mongo and redis.cache_store_connection - Attribute type: DB instance object - Should be used only when the cache_store is set to "mongo" or "redis". This is necessary for production environments so you can specify the host, port, database, user and password to use to connect to the respective caching database selected.NoteWhen using redis or mongo as caching database solutions, the appropriate python connector libraries will be required (pymongo / redis).
For additional information in regards of howrequests_cacheworks, please review their docs:https://requests-cache.readthedocs.io/en/latest/UPCOMING- HMAC256 supportSUGGESTIONS?Please feel free to email me atadrian.lazar95@outlook.comorlzr.adrian95@gmail.com. I am opened to improvement / suggestions and critics.