/Wiki/sources/honojs__hono/2026/https-hono-dev-llms-full-txt-what-this-middlewar-8c5fc4d19bd4-what-this-middleware-validates-s0319-c0000.md
What this middleware validates (1) - hono-docs
What this middleware validates (1) Source evidence: /Sources/raw/honojs hono/honojs hono.md Canonical citation: https://hono.dev/llms full.txt what this midd...
What this middleware validates (1)
Source evidence: /Sources/raw/honojshono/honojshono.md Canonical citation: https://hono.dev/llms-full.txt#what-this-middleware-validates
Summary
For each token, jwk(): - Parses and validates the JWT header format. - Requires a kid header and finds a matching key by kid. - Rejects symmetric algorithms (HS256, HS384, HS512). - Requires the header alg to be included in...
Content
For each token, jwk():
- Parses and validates the JWT header format.
- Requires a
kidheader and finds a matching key bykid. - Rejects symmetric algorithms (
HS256,HS384,HS512). - Requires the header
algto be included in the configuredalgallowlist. - If a matched JWK has an
algfield, requires it to match the JWT headeralg. - Verifies the token signature with the matched key.
- By default, validates time-based claims:
nbf,exp, andiat.
Optional claim validation can be configured with the verification option:
iss: validates issuer when provided.aud: validates audience when provided.
If you need additional token checks beyond the above (for example, custom application-level authorization rules), add them in your own middleware after jwk().
:::info The Authorization header sent from the client must have a specified scheme.
Kinic Wiki