TJwtMiddleware Class

HTTP server middleware that authenticates requests using a JSON Web Token (JWT) sent as a Bearer token.

Remarks

The middleware reads the Authorization header, extracts the Bearer token, validates its signature and claims, and builds an IUserIdentity from the token claims which is assigned to the request user. The validation behavior is controlled by properties such as Secret, AllowExpiredToken, ExpectedAudiences and ExpectedIssuers, and can be extended through the OnGetSecret, OnForbidRequest and BeforeValidation callbacks.

Syntax

Unit: Sparkle.Middleware.Jwt

TJwtMiddleware = class(THttpServerMiddleware, IJwtMiddleware);

Constructors

Name	Description
Create	Overloaded Create Create(string, Boolean, Boolean) Create(TBytes, Boolean, Boolean)

Methods

Name	Description
DeserializeIdentity	Validates the specified token and builds a user identity from its claims.
ProcessRequest	Processes the request, authenticating it from the Bearer token and forwarding it to the next handler.

Properties

Name	Description
AllowedClockSkew	Gets or sets the tolerance, in seconds, applied when checking time-based claims such as "exp" and "nbf".
AllowExpiredToken	Indicates whether an expired token is still accepted as valid.
BeforeValidation	The callback invoked just before validation, allowing custom validation rules to be added.
ExpectedAudiences	Gets or sets the list of accepted values for the "aud" (audience) claim. When empty, no audience check is done.
ExpectedIssuers	Gets or sets the list of accepted values for the "iss" (issuer) claim. When empty, no issuer check is done.
ForbidAnonymous​Access	Indicates whether requests without a valid token are rejected.
IgnoreInvalidJwt	Indicates whether an invalid token is ignored, letting the request continue as anonymous instead of being rejected.
OnForbidRequest	The callback invoked to decide whether each request must be rejected, regardless of the token state.
OnGetSecret	The callback invoked to provide the secret used to validate each token.
RequireExpiration​Time	Indicates whether validation fails when the "exp" (expiration time) claim is not present.
RequireIssuedAt	Indicates whether validation fails when the "iat" (issued at) claim is not present.
RequireNotBefore	Indicates whether validation fails when the "nbf" (not before) claim is not present.
Secret	Gets or sets the secret (key) used to validate the token signature.
SkipKeyValidation	Indicates whether the secret (key) validation is skipped, allowing keys that do not meet the default requirements.