jwk.validate / jwk.isValid

Strict RFC 7517 §4 (common) + RFC 7518 §6 (per-kty) + RFC 8037 §2 (OKP) shape enforcement. Runs on every importJWK and every thumbprint implicitly — call it directly when you’re receiving JWKs at a system boundary (JWKS fetch, admin panel input, DB read).

import { jwk } from '@exortek/jwk'
 
jwk.validate(untrustedJwk)                                 // throws JwkError on failure
jwk.validate(untrustedJwk, { requirePublic: true })        // additional guard
const ok = jwk.isValid(untrustedJwk)                       // non-throwing variant

What gets checked

Common members (RFC 7517 §4)

use × key_ops consistency (§4.3)

When both are set the JWK MUST be consistent:

Any key_ops entry outside its use’s allowlist raises KEY_OPS_CONFLICT with the offending op named.

Per-kty members

• EC — crv in the supported set; x, y decode to EC_COORD_BYTES[crv] bytes; d (private) same length.
• RSA — n, e present and base64url; d (private) present; CRT parameters p / q / dp / dq / qi all present or all absent (partial sets rejected — RFC 7518 §6.3.2).
• oct — k present, base64url, non-empty.
• OKP — crv in the RFC 8037 set; x decodes to OKP_KEY_BYTES[crv] bytes; d (private) same length.

requirePublic / requirePrivate guards

Assert secret-carrying state at the JWK boundary — no more “did I get the private form by accident?” foot-guns:

// Endpoints that publish JWKS: refuse anything carrying secrets.
jwk.validate(receivedJwk, { requirePublic: true })
 
// Endpoints that sign / decrypt: refuse public-only material.
jwk.validate(receivedJwk, { requirePrivate: true })

Both are opt-in — the default (validate(jwk)) accepts either shape.

isValid — non-throwing filter

Handy for JWKS ingestion, where a single bad key shouldn’t kill the whole set:

const rotationSet = (jwks.keys || []).filter(k => jwk.isValid(k, { requirePublic: true }))

isValid swallows JwkError and returns false; any other error type (a bug in a validator) still throws.

Errors