Skip to content

feat(paseto): add --validate-claims and --clock-skew to decode (Closes #108) - #123

Merged
sgaunet merged 1 commit into
mainfrom
feat/paseto-validate-claims-issue-108
Aug 25, 2026
Merged

sgaunet merged 1 commit into
mainfrom
feat/paseto-validate-claims-issue-108

Conversation

@sgaunet

@sgaunet sgaunet commented Aug 25, 2026

Copy link
Copy Markdown
Owner

No description provided.

Bring the PASETO decode commands to parity with the JWT ones, which have
exposed these two flags since they gained claims validation. Decoding stays
permissive by default: only the opt-in flag changes behaviour.

- add paseto.WithValidation and ValidationOptions, threaded through every
  encoder/decoder constructor as a variadic option
- enforce exp and nbf with custom go-paseto rules rather than the stock
  NotExpired, which fails on an absent exp; a claim that is not present is not
  enforced, matching golang-jwt
- classify a rule failure as the new ErrClaimsNotValid, wrapping ErrTokenExpired
  or ErrTokenNotYetValid, so an expired token is no longer reported as an
  invalid one
- register --validate-claims and --clock-skew on "paseto decode"
- cover all six version/purpose combinations in unit, command and venom tests
- update the README, the package doc and the command help

Closes #108
@sgaunet sgaunet self-assigned this Aug 25, 2026
@sgaunet sgaunet added the feature New feature label Aug 25, 2026
@sgaunet
sgaunet merged commit f943eef into main Aug 25, 2026
4 checks passed
@sgaunet
sgaunet deleted the feat/paseto-validate-claims-issue-108 branch August 25, 2026 00:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

feature New feature

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant