Docs / Configuration

Make the expected policy explicit.

AuthLint v0.1 uses JSON configuration to describe the identity policy against which a JWT is validated.

Example configuration

authlint.jsonjson

{
  "issuer": "https://issuer.example",
  "audiences": ["my-service"],
  "jwks_file": "./jwks.json",
  "allowed_algorithms": ["RS256", "ES256"],
  "required": {
    "exp": true,
    "iss": true,
    "aud": true
  },
  "clock_skew_seconds": 30
}

Policy fields

FieldPurpose

issuerExpected issuer value.

audiencesOne or more accepted audience values.

jwks_file / jwks_urlExactly one public JSON Web Key Set source.

allowed_algorithmsAlgorithms accepted by the policy.

requiredClaims that must be present.

clock_skew_secondsAllowed validation window for clock differences.

Secure defaults

Remote JWKS access is explicit because it introduces network behavior into local and CI validation. The default algorithm policy permits commonly deployed asymmetric algorithms and excludes none and symmetric algorithms until an explicit shared-secret policy exists.

AuthLint warns when configured clock skew exceeds 300 seconds. Fix clock synchronization rather than compensating with a large validation window.