SERVER / JWT

JWT

JWT is Dowe's Dowe-owned server utility for signing, verifying, encrypting, and decrypting tokens without Node.js, npm packages, or client-side secrets.

1 / MENTAL MODEL

Bind each JWT result directly

jwt binds a token or verification result directly. Its secret or key stays server-only for the current handler or middleware, and the old let value = jwt form is rejected.

dowe
handler createSession
  jwt token secret:env.JWT_SECRET algorithm:"HS256" claims:{ sub:"user-1" }
  return json:{ ok:true token:token }
Part
Contract

No data

There are no records to display

2 / SIGNED TOKENS

Verify bearer tokens before trusting claims

bearer only extracts the token. jwt verified validates the HS256 signature and standard time claims before middleware explicitly calls next.

dowe
middleware requireBearer params:{}
  bearer token value:req.header.Authorization
  jwt verified secret:env.JWT_SECRET algorithm:"HS256" token:token
  if verified.valid
    next
  return status:401 json:{ ok:false error:"Unauthorized" }
Operation
Result

No data

There are no records to display

3 / ENCRYPTED TOKENS

Use a separate JWE variable for encrypted claims

JWE uses direct key management with A256GCM. jwt infers encryption from key plus claims, and decryption from key plus token.

dowe
handler createEncryptedSession
  jwt token key:env.JWT_KEY algorithm:"dir" encryption:"A256GCM" claims:{ sub:"user-1" }
  return json:{ token:token }

4 / SECURITY

Fail closed and keep authority on the server

Dowe rejects alg:none, unsupported algorithms, missing server environment values, invalid signatures, expired tokens, and tokens that are not yet valid. Declare secret names in .env.example and supply values through .env or the process environment. Runtime errors do not log tokens, headers, keys, or secrets.

Rule
Why it matters

No data

There are no records to display