JWT VARIABLE
jwt token
Binds the compact token or validation result inside the current action.
SERVER / JWT
JWT
JWT is Dowe's Rust-owned server utility for signing, verifying, encrypting, and decrypting tokens without Node.js, npm packages, or client-side secrets.
KV documentation
MENTAL MODEL
Bind each JWT result directly
jwt binds a token or verification result directly. Its secret or key stays server-only for the current handler or middleware, and the old let value = jwt form is rejected.
handler createSession
jwt token secret:env.JWT_SECRET algorithm:"HS256" claims:{ sub:"user-1" }
return response json:{ ok:true token:token }RESULT
claims or token
claims creates a token; token validates or decrypts an existing token.
BOUNDARY
Server only
Views receive only deliberate response data, never JWT secrets, keys, or utility state.
SIGNED TOKENS
Verify bearer tokens before trusting claims
bearer only extracts the token. jwt verified validates the HS256 signature and standard time claims before middleware explicitly calls next.
middleware requireBearer params:{}
bearer token value:req.header.Authorization
jwt verified secret:env.JWT_SECRET algorithm:"HS256" token:token
if verified.valid
next
return response status:401 json:{ ok:false error:"Unauthorized" }Sign
Uses secret plus HS256 and returns a compact signed JWS token.
Verify
Returns valid and trusted claims only after signature and configured claim checks pass.
ENCRYPTED TOKENS
Use a separate JWE variable for encrypted claims
JWE uses direct key management with A256GCM. jwt infers encryption from key plus claims, and decryption from key plus token.
handler createEncryptedSession
jwt token key:env.JWT_KEY algorithm:"dir" encryption:"A256GCM" claims:{ sub:"user-1" }
return response json:{ token:token }SECURITY
Fail closed and keep authority on the server
Dowe rejects alg:none, unsupported algorithms, missing server environment values, invalid signatures, expired tokens, and tokens that are not yet valid. Declare secret names in .env.example and supply values through .env or the process environment. Runtime errors do not log tokens, headers, keys, or secrets.
No Node.js
JWT behavior is executed by shared Rust crates, not user JavaScript or an external crypto CLI.
No client secrets
secret and key values must be referenced only from server source and never enter client artifacts.
Explicit migration
Replace let result = jwt operations and const bindings with one jwt result declaration.