Gaseto

Gaseto is a Gleam implementation of PASETO (Platform-Agnostic SEcurity TOkens).

New to PASETO? These explain what it is and why it exists:

• paseto.io: what PASETO is.
• No Way, JOSE!: the weaknesses of JWT that PASETO fixes.
• The PASETO specification: the details this library follows.

Features

Supports versions 3 and 4, both local and public tokens. Use version 4 unless you are limited to NIST-approved algorithms, then use version 3, which uses them throughout. Versions 1 and 2 are deprecated by the spec and not supported.

Installation

gleam add gaseto

Gaseto runs on Erlang and needs OTP 27 or newer.

Usage

import gaseto.{PasetoV4}
import gleam/option

pub fn main() -> Nil {
  let assert Ok(key) = gaseto.local_key_from_hex(PasetoV4, key_hex)

  let claims = gaseto.new_claims() |> gaseto.with_subject("user-42")
  let assert Ok(token) = gaseto.encrypt(claims, key)

  let assert Ok(decrypted) = gaseto.decrypt(token, key, gaseto.new_rules())
  assert gaseto.subject(decrypted) == option.Some("user-42")
}

To choose, load and make keys, see the keys guide (source).

Using it with HTTP

To send tokens in HTTP responses and check them on requests, use gaseto_http. It works with Wisp, Mist and other servers built on gleam_http.

The demo directory has small projects that show Gaseto in use.

Further documentation can be found at https://hexdocs.pm/gaseto.

Development

gleam test  # Run the tests

To check that Gaseto and go-paseto accept each other’s tokens, which needs Go:

(cd interop && go run . make go_tokens.json)
gleam run -m interop
(cd interop && go run . check gaseto_tokens.json)