isCodeMieJwtToken function

bool isCodeMieJwtToken(
  1. String token
)

True when token looks like a JWT (header.payload.signature). This is a shallow format check; codeMieJwtExpired validates the payload too. Cookie strings (k=v; k=v) are rejected because they can also contain dots and split into three parts. JWT padding (=) is allowed and normalized during decoding.

Implementation

bool isCodeMieJwtToken(String token) {
  final trimmed = token.trim();
  if (trimmed.isEmpty) return false;
  // Cookie-auth strings always contain `;`; a raw JWT never does.
  if (trimmed.contains(';')) return false;
  final parts = trimmed.split('.');
  if (parts.length != 3 || parts.any((p) => p.isEmpty)) return false;
  // Validate that the header decodes as base64url JSON.
  try {
    final header = jsonDecode(
      utf8.decode(base64Url.decode(base64Url.normalize(parts[0]))),
    );
    return header is Map;
  } on Object {
    return false;
  }
}