class JwtTagger

• JwtTagger
• Tagger
• Reference
• Object

Defined in:

Constant Summary

AUTH_PATH_PARTS = Set {"auth", "authenticate", "authentication", "login", "signin", "sign_in", "token", "refresh", "jwt"}

EXCLUDED_TOKEN_NAMES = Set {"csrf_token", "xsrf_token", "authenticity_token", "anti_csrf_token", "captcha_token", "recaptcha_token", "turnstile_token"}

NON_BEARER_SCHEMES = /\A\s*(basic|digest|negotiate|ntlm|hoba|aws4|hmac)\b/i

HTTP auth schemes that are not bearer/JWT; when an Authorization value advertises one of these, the header is not a JWT signal.

NON_JWT_TOKEN_HINTS = ["csrf", "xsrf", "captcha", "recaptcha", "turnstile", "authenticity", "nonce", "reset", "unlock", "confirmation", "verification", "invitation", "activation", "remember", "unsubscribe", "page", "pagination", "next", "continuation", "cursor", "sync"] of ::String

Substrings that mark a *_token param as an opaque, non-JWT token: CSRF/anti-bot tokens, Rails/Devise lifecycle tokens (password reset, email confirmation, account unlock/activation, remember-me, invites), and API pagination cursors. These are random strings, not signed JWTs, so counting them as JWT signals produces false positives on otherwise auth-shaped routes.

STRONG_NAMES = Set {"jwt", "bearer", "authorization", "access_token", "refresh_token", "id_token", "auth_token", "api_token", "x_api_token", "x_access_token"}

Constructors

• .new(options : Hash(String, YAML::Any))

Instance Method Summary

• #perform(endpoints : Array(Endpoint))

Constructor Detail

Instance Method Detail