demo: api shield → jwt validation

GET /api/shield-jwt is protected by api shield's jwt validation. api shield fetches the site's jwks at /.well-known/jwks.json and validates every request's Authorization: Bearer header against it. valid, unexpired, correctly-signed → 200. missing, expired, or tampered → 403 from api shield, function never runs.

# mint a token

# call the protected endpoint

# from your terminal

# mint
JWT=$(curl -s "https://rhocfsandbox.com/api/get-demo-jwt?exp=300" | jq -r .jwt)

# valid → 200
curl -si "https://rhocfsandbox.com/api/shield-jwt" -H "Authorization: Bearer $JWT" | head -1

# no token → 403 (or 400 depending on rule config)
curl -si "https://rhocfsandbox.com/api/shield-jwt" | head -1

# tampered → 403
curl -si "https://rhocfsandbox.com/api/shield-jwt" -H "Authorization: Bearer ${JWT}xxx" | head -1

# notes

• api shield allows ±60 seconds of clock drift on exp and nbf. the "mint expired" button issues a token 300 seconds in the past so the drift tolerance can't rescue it.
• the site's public key is available at /.well-known/jwks.json. api shield holds the key inline (per this config's credentials.keys), so the well-known endpoint is informational.

# config