(decoded_jwt, expected_issuer, expected_domain=None)
Decode and validate a JSON Web token (JWT).

    Cloud IAP:
    https://cloud.google.com/iap/docs/signed-headers-howto

    Google OpenID Connect:
    https://developers.google.com/identity/protocols/OpenIDConnect

    Args:
        decoded_jwt: A dict object containing the decoded JWT token.
        expected_issuer: Expected issuer of the JWT.
        expected_domain: Expected GSuite domain in the JWT (optional).

    Raises:
        JwtValidationError: If unable to validate the JWT.
Decode and validate a JSON Web token (JWT).
Decode and validate a JSON Web token ( JWT ) .
def validate_jwt(decoded_jwt, expected_issuer, expected_domain=None):
    """Decode and validate a JSON Web token (JWT).

    Cloud IAP:
    https://cloud.google.com/iap/docs/signed-headers-howto

    Google OpenID Connect:
    https://developers.google.com/identity/protocols/OpenIDConnect

    Args:
        decoded_jwt: A dict object containing the decoded JWT token.
        expected_issuer: Expected issuer of the JWT.
        expected_domain: Expected GSuite domain in the JWT (optional).

    Raises:
        JwtValidationError: If unable to validate the JWT.
    """
    # Make sure the token is not created in the future or has expired.
    try:
        now = int(time.time())
        issued_at = decoded_jwt['iat']
        if isinstance(issued_at, six.string_types):
            issued_at = int(issued_at, 10)

        expires_at = decoded_jwt['exp']
        if isinstance(expires_at, six.string_types):
            expires_at = int(expires_at, 10)

        if issued_at > now:
            raise JwtValidationError('Token was issued in the future')
        if expires_at < now:
            raise JwtValidationError('Token has expired')
    except KeyError as e:
        raise JwtValidationError('Missing timestamp: {}'.format(e)) from e

    # Check that the issuer of the token is correct.
    try:
        issuer = decoded_jwt['iss']
        if issuer != expected_issuer:
            raise JwtValidationError('Wrong issuer: {}'.format(issuer))
    except KeyError as e:
        raise JwtValidationError('Missing issuer') from e

    if 'email' not in decoded_jwt:
        raise JwtValidationError('Missing email field in token')

    if expected_domain:
        try:
            domain = decoded_jwt['hd']
            if not domain == expected_domain:
                raise JwtValidationError('Wrong domain: {}'.format(domain))
        except KeyError as e:
            raise JwtValidationError('Missing domain: {}'.format(e)) from e
def validate_jwt ( decoded_jwt , expected_issuer , expected_domain = None ) : # Make sure the token is not created in the future or has expired. try : now = int ( time . time ( ) ) issued_at = decoded_jwt [ 'iat' ] if isinstance ( issued_at , six . string_types ) : issued_at = int ( issued_at , 10 ) expires_at = decoded_jwt [ 'exp' ] if isinstance ( expires_at , six . string_types ) : expires_at = int ( expires_at , 10 ) if issued_at > now : raise JwtValidationError ( 'Token was issued in the future' ) if expires_at < now : raise JwtValidationError ( 'Token has expired' ) except KeyError as e : raise JwtValidationError ( 'Missing timestamp: {}' . format ( e ) ) from e # Check that the issuer of the token is correct. try : issuer = decoded_jwt [ 'iss' ] if issuer != expected_issuer : raise JwtValidationError ( 'Wrong issuer: {}' . format ( issuer ) ) except KeyError as e : raise JwtValidationError ( 'Missing issuer' ) from e if 'email' not in decoded_jwt : raise JwtValidationError ( 'Missing email field in token' ) if expected_domain : try : domain = decoded_jwt [ 'hd' ] if not domain == expected_domain : raise JwtValidationError ( 'Wrong domain: {}' . format ( domain ) ) except KeyError as e : raise JwtValidationError ( 'Missing domain: {}' . format ( e ) ) from e