{"id":19725000,"url":"https://github.com/nickufer/proxy-wasm-opaque-to-jwt","last_synced_at":"2026-06-08T13:32:50.685Z","repository":{"id":45272736,"uuid":"411830447","full_name":"NickUfer/proxy-wasm-opaque-to-jwt","owner":"NickUfer","description":"ProxyWASM filter to convert opaque tokens to JWT tokens","archived":false,"fork":false,"pushed_at":"2022-10-31T14:53:08.000Z","size":55,"stargazers_count":0,"open_issues_count":2,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-05-30T08:27:52.176Z","etag":null,"topics":["hacktoberfest","jwt","proxy-wasm"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/NickUfer.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-09-29T21:10:41.000Z","updated_at":"2022-10-31T14:43:54.000Z","dependencies_parsed_at":"2023-01-20T15:46:40.796Z","dependency_job_id":null,"html_url":"https://github.com/NickUfer/proxy-wasm-opaque-to-jwt","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/NickUfer/proxy-wasm-opaque-to-jwt","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NickUfer%2Fproxy-wasm-opaque-to-jwt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NickUfer%2Fproxy-wasm-opaque-to-jwt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NickUfer%2Fproxy-wasm-opaque-to-jwt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NickUfer%2Fproxy-wasm-opaque-to-jwt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/NickUfer","download_url":"https://codeload.github.com/NickUfer/proxy-wasm-opaque-to-jwt/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NickUfer%2Fproxy-wasm-opaque-to-jwt/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34065349,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-08T02:00:07.615Z","response_time":111,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacktoberfest","jwt","proxy-wasm"],"created_at":"2024-11-11T23:27:50.170Z","updated_at":"2026-06-08T13:32:50.667Z","avatar_url":"https://github.com/NickUfer.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Proxy WASM - Opaque To JWT Auth Token\n\nThis is a http proxy filter which converts opaque authorization tokens to signed JWT's\ncontaining claims provided by an OAuth2 token introspection endpoint.\nRFC: [OAuth 2.0 Token Introspection](https://datatracker.ietf.org/doc/html/rfc7662)\n\n## Build From Source\n\nRun make in the project root:\n```shell\nmake build\n```\nThe built wasm file should be located at `target/wasm32-wasi/release/proxy_wasm_opaque_to_jwt.wasm`.\n\n## Configuration\n\nAn example configuration of the filter.\n\n```yaml\nintrospect_endpoint:\n  authority: \"id.example.com\" # Hostname of the endpoint\n  path: \"/oauth2/introspect\" # Introspection endpoint path\n  upstream: \"oauth2-authorization-serve\" # Under e.g. Envoy Proxy the name of the cluster which provides the endpoint\njwt:\n  key: '' # Key to use for jwt signing. Generate new key with command \"openssl genpkey -algorithm ed25519\"\n  output_header_name: \"X-JWT-User\" # Header name to store the JWT in. This header is appended to the incoming request available for upstream services\n  algorithm: \"EdDSA\" # Algorithm to use for jwt signing\n  jsonnet_template: |- # Jsonnet function to use for transforming the introspection data to jwt claims\n    function(introspect_json) {\n      // If expiration is not set, set it to 0 to make it invalid\n      exp: if(std.objectHas(introspect_json, \"exp\")) then introspect_json.exp else 0,\n      iat: if(std.objectHas(introspect_json, \"iat\")) then introspect_json.iat,\n      nbf: if(std.objectHas(introspect_json, \"nbf\")) then introspect_json.nbf,\n      iss: if(std.objectHas(introspect_json, \"iss\")) then introspect_json.iss,\n      // If supplied aud is not an array convert it to one with 1 element.\n      aud: if(std.objectHas(introspect_json, \"aud\")) then (if(std.isArray(introspect_json.aud)) then introspect_json.aud else [introspect_json.aud]),\n      jti: if(std.objectHas(introspect_json, \"jti\")) then introspect_json.jti,\n      sub: if(std.objectHas(introspect_json, \"sub\")) then introspect_json.sub\n    }\n```\n\nA full example envoy v3 config can be found in [examples/envoy-minimal.yml](examples/envoy-minimal.yml).\n\n#### Supported Signing Algorithms\n\n|Algorithm|Supported|\n|---|---|\n|HMAC|\n|`HS256`|:heavy_check_mark:|\n|`HS384`|:heavy_check_mark:|\n|`HS512`|:heavy_check_mark:|\n|RSA|\n|`RS256`|:heavy_check_mark:|\n|`RS384`|:heavy_check_mark:|\n|`RS512`|:heavy_check_mark:|\n|`PS256`|:heavy_check_mark:|\n|`PS384`|:heavy_check_mark:|\n|`PS512`|:heavy_check_mark:|\n|ECDSA *(support planned)*||\n|`ES256`|:construction:|\n|`ES384`|:construction:|\n|`ES512`|:construction:|\n|EdDSA|\n|`EdDSA`|:heavy_check_mark:|\n\n#### JWT claims\n\nThese claims are included in the JWT by default if provided:\n\n|Claim|Supported|\n|---|---|\n|`exp`|:heavy_check_mark:|\n|`iat`|:heavy_check_mark:|\n|`nbf`|:heavy_check_mark:|\n|`iss`|:heavy_check_mark:|\n|`aud` *(as array)*|:heavy_check_mark:|\n|`jti`|:heavy_check_mark:|\n|`sub`|:heavy_check_mark:|\n\n##### Change the JWT claims\n\nWith [Jsonnet](https://jsonnet.org/) you are able to include custom claims\nor synthesize new ones or add static claims.\n\nThe default claims already use a [jsonnet template](src/default.jsonnet) to construct the JWT token.\nWith help from [jsonnet.org](https://jsonnet.org/learning/tutorial.html) and the default template\nyou should be able to change the generated JWT to your requirements.\n\nThis filter uses [Top-Level Arguments](https://jsonnet.org/learning/tutorial.html#parameterize-entire-config).\nBasically the filter needs a function which generates the jwt claims. It is called with the introspection json as a parameter.\nIn the function you can add all claims you want to add to your jwt token. An example can be found at [src/default.jsonnet](src/default.jsonnet).\n```jsonnet\nfunction(introspect_json) {\n  // ... put your claims inside here\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnickufer%2Fproxy-wasm-opaque-to-jwt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnickufer%2Fproxy-wasm-opaque-to-jwt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnickufer%2Fproxy-wasm-opaque-to-jwt/lists"}