How to verify an ES256 JWT in Rust

1[dependencies]
2jsonwebtoken = { version = "=11.1.0", features = ["rust_crypto"] } # or "aws_lc_rs"
3serde = { version = "1", features = ["derive"] }
4 

1use jsonwebtoken::{Algorithm, DecodingKey, Validation, decode};
2use serde::Deserialize;
3 
4#[derive(Debug, Deserialize)]
5struct Claims {
6    sub: String,
7    exp: u64,
8}
9 
10fn main() -> Result<(), Box<dyn std::error::Error>> {
11    let token = std::fs::read_to_string("token.txt")?;
12    let key = DecodingKey::from_ec_pem(&std::fs::read("pub.pem")?)?; // SPKI "BEGIN PUBLIC KEY"
13 
14    let mut validation = Validation::new(Algorithm::ES256); // the only algorithm accepted
15    validation.set_issuer(&["https://ecdsa.com"]); // checked only if the token has an iss…
16    validation.set_required_spec_claims(&["exp", "iss", "sub"]); // …so require it as well
17    validation.validate_nbf = true; // off by default
18    validation.leeway = 30; // seconds of clock skew; the default is 60
19 
20    let data = decode::<Claims>(token.trim(), &key, &validation)?;
21    println!("valid ES256 token for {}, exp {}", data.claims.sub, data.claims.exp);
22    Ok(())
23}
24 

How it works

1. DecodingKey::from_ec_pem reads the SPKI BEGIN PUBLIC KEY block; for keys from a JWKS endpoint use DecodingKey::from_jwk instead.
2. Validation::new(Algorithm::ES256) accepts that one algorithm only: a token whose header says HS256 fails with InvalidAlgorithm before any signature work.
3. decode::<Claims> verifies the 64-byte r‖s signature over the header.payload text, then deserializes the payload into your struct — a missing or mistyped field is an error, not a silent default.
4. Errors carry a kind: the run produces InvalidSignature, InvalidAlgorithm, ExpiredSignature and MissingRequiredClaim("iss") for a swapped payload, a relabelled header, an expired token and a token without an issuer.

Gotchas

• set_issuer (and set_audience) only compare the claim when the token has one. A token without iss passes unless "iss" is in set_required_spec_claims — the default requires only exp.
• nbf is not checked unless you set validate_nbf = true, and exp gets 60 seconds of leeway by default.
• validate_aud is on by default: a token that carries an aud claim fails with InvalidAudience until you call set_audience with an expected value.
• Without exactly one of the rust_crypto or aws_lc_rs features, jsonwebtoken 11 compiles but panics at the first verification with Could not automatically determine the process-level CryptoProvider.
• jsonwebtoken::dangerous::insecure_decode and insecure_decode_claims skip the signature and all claim checks. They exist for debugging; nothing read through them may be trusted.

Related recipes

• How to verify an ECDSA signature in Rust
• How to convert an ECDSA signature between DER and raw in Rust
• How to verify an ES256 JWT in Go
• How to verify an ES256 JWT in C# (.NET)
• How to verify an ES256 JWT in Node.js