set-jwt-verify.xml

[wyvern8]

this is really interesting - we are using the central auth behavior in order to verify jwt.. any detail on how to verify expiry as well as signing? btw, i have a little side project you might be interested in:

https://github.com/wyvern8/akamai-nginx

[colinbendell]

Are you using jwk as well? I have a second part to this that does the jwk bits as well that plugs into this jwt verifier.

[wyvern8]

we are using a jwt library from auth0 to check the signing with local pubkey, and the "exp" attribute of the jwt to validate assertions. exp is just a timestamp, so should be easy enough to add i guess.