Create JWT Validation Flow

[tmthecoder]

Create JWT Validation Flow

Context

We need to provide an API endpoint that ingests a JWT and returns whether it is valid or not

Requirements & Criteria

• All logic is written within the auth service
• This is NOT an exposed endpoint (only in use from other local services, not as an API endpoint)
• The Request Body is validated to follow these guidelines:
  • EMPTY
• Request contains an Authorization header with Bearer [JWT] as the value
• Return a 200 response if valid
• Return a 401 response if invalid
• Validation Criteria:
  • JWT is valid
  • API Key hash is found in list of API Keys (in case the key was revoked while this token was still active)

Testing

• Please ensure there are tests written for the following cases (at a minimum):
  • JWT Validation with an empty payload
  • JWT Validation with a JWT whose issuing API key has been revoked
  • JWT Validation with an invalid JWT (either with an invalid payload + invalid signature)
  • JWT Validation with a valid token