verifyJwt static method

bool verifyJwt(String jwt, { required BigInt qx, required BigInt qy, })

Verify an ES256 jwt's signature against the Verify key (qx, qy): P-256 ECDSA over SHA-256(header.claims), the 64-byte r||s signature. Returns false on any malformation - never throws.

Implementation

static bool verifyJwt(String jwt, {required BigInt qx, required BigInt qy}) {
  try {
    final parts = jwt.split('.');
    if (parts.length != 3) return false;
    final sig = base64Url.decode(_normalizeB64(parts[2]));
    if (sig.length != 64) return false;
    final signed =
        Uint8List.fromList(utf8.encode('${parts[0]}.${parts[1]}'));
    final hash = sha256(signed);
    return P256.verifyRaw(
      hash: hash,
      r: Uint8List.fromList(sig.sublist(0, 32)),
      s: Uint8List.fromList(sig.sublist(32)),
      qx: qx,
      qy: qy,
    );
  } catch (_) {
    return false;
  }
}