Issuing and verifying JSON Web Tokens (HS/RS/ES) for sessions or service-to-service auth.
Overview
Sign & verify JWTs — symmetric HS256/384/512 and asymmetric RS256/ES256 — with strict expiry/issuer/audience checks over Web Crypto, so it runs on edge and workers. Plus remote JWKS verification, refresh-token rotation with reuse detection, and opaque & CSRF tokens. A tiny jose alternative.
Install
$ npm install @lacspace/jwt
Quick example
@lacspace/jwtts
await verify(token, secret, { issuer })
Returns payload
Tips
Keep access tokens short-lived and rotate refresh tokens; verify `exp`/`nbf` (the package does this).
For RS/ES, publish a JWKS and verify against it.
Zero-dependency and isomorphic — safe to import on the server, in the browser, on the edge and in React Native. It tree-shakes, so you only ship what you import.
Watch out for
Never accept the `alg: none` algorithm, and don't verify HS tokens with a public key — the verifier guards against algorithm confusion.
