Enum IdentityError 

#[non_exhaustive]
pub enum IdentityError {
    Malformed(String),
    MissingKid,
    UnknownKid(String),
    AlgorithmRejected {
        alg: String,
        kid: String,
    },
    Verification(String),
    TtlTooLong(u64),
    BadTimestamps {
        iat: u64,
        exp: u64,
    },
    FutureIat {
        iat: u64,
        now: u64,
    },
    EmptyField(&'static str),
    SpoofingCharacter(&'static str),
    BadIssuer(String),
    Jwks(String),
    ScopeEscalation {
        scope: String,
    },
    ExpEscalation {
        child: u64,
        parent: u64,
    },
    ChainTooDeep(usize),
}

Identity validation failures.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Malformed(String)

Token structurally malformed.

MissingKid

Header lacks a kid.

UnknownKid(String)

No key registered for this kid.

AlgorithmRejected

Token alg is not accepted, or does not match the key type for its kid (algorithm-confusion defense).

Fields

alg: String

Stated algorithm.

kid: String

Key id.

Verification(String)

Signature invalid / expired / nbf future / wrong audience — collapsed by jsonwebtoken; the detail string preserves the cause.

TtlTooLong(u64)

exp - iat exceeds the 15-minute NHI cap.

BadTimestamps

exp ≤ iat or other timestamp nonsense.

Fields

iat: u64

Issued-at.

exp: u64

Expiry.

FutureIat

iat is unreasonably far in the future.

Fields

iat: u64

Issued-at claim.

now: u64

Validator wall clock.

EmptyField(&'static str)

Required identity field empty.

SpoofingCharacter(&'static str)

Field carries a bidi override or zero-width character that would spoof how the identity renders in a log or audit view.

BadIssuer(String)

Issuer not in the allowlist.

Jwks(String)

JWKS document was malformed or contained no supported signing keys.

ScopeEscalation

Child scopes exceed parent scopes.

Fields

scope: String

The offending scope.

ExpEscalation

Child outlives parent.

Fields

child: u64

Child expiry.

parent: u64

Parent expiry.

ChainTooDeep(usize)

Delegation chain deeper than permitted.

Trait Implementations

impl Debug for IdentityError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for IdentityError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for IdentityError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for IdentityError

fn eq(&self, other: &IdentityError) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for IdentityError

impl StructuralPartialEq for IdentityError