developer-delphi-horse-jwt

To validate JWT Bearer tokens in Delphi Horse routes, apply the HorseJWT middleware with a secret key to intercept the Authorization header and enforce token checks before executing the route handler. It supports global middleware protection and per-route configuration.

When protecting API endpoints with JWT middleware in Delphi, you can enforce claims validation including subject, issued at, expiration, audience, and not before. THorseJWTConfig allows you to mark these claims as required and specify an expected audience.

Yes, you can exclude specific public routes from JWT authentication in your Horse web server by configuring the SkipRoutes property within THorseJWTConfig. This allows you to keep certain endpoints accessible without requiring an Authorization header token.

To access JWT claims inside a Delphi Horse route handler, use the Req.Session<TJWT> integration. By configuring the SessionClass property, the middleware populates the session object with parsed claims like subject and expiration for retrieval.

Yes, you need the delphi-jose-jwt library, specifically the JOSE.Core.JWT dependency, to implement token authentication in a Horse API. This middleware integrates directly with that library to parse and validate the JSON Web Tokens.