usingGoogle.Apis.Auth;usingGoogle.Apis.Auth.OAuth2;usingSystem;usingSystem.Threading;usingSystem.Threading.Tasks;publicclassIAPTokenVerification{/// <summary>/// Verifies a signed jwt token and returns its payload./// </summary>/// <param name="signedJwt">The token to verify.</param>/// <param name="expectedAudience">The audience that the token should be meant for./// Validation will fail if that's not the case.</param>/// <param name="cancellationToken">The cancellation token to propagate cancellation requests.</param>/// <returns>A task that when completed will have as its result the payload of the verified token.</returns>/// <exception cref="InvalidJwtException">If verification failed. The message of the exception will contain/// information as to why the token failed.</exception>publicasyncTask<JsonWebSignature.Payload>VerifyTokenAsync(stringsignedJwt,stringexpectedAudience,CancellationTokencancellationToken=default){SignedTokenVerificationOptionsoptions=newSignedTokenVerificationOptions{// Use clock tolerance to account for possible clock differences// between the issuer and the verifier.IssuedAtClockTolerance=TimeSpan.FromMinutes(1),ExpiryClockTolerance=TimeSpan.FromMinutes(1),TrustedAudiences={expectedAudience},TrustedIssuers={"https://cloud.google.com/iap"},CertificatesUrl=GoogleAuthConsts.IapKeySetUrl,};returnawaitJsonWebSignature.VerifySignedTokenAsync(signedJwt,options,cancellationToken:cancellationToken);}}

import("context""fmt""io""google.golang.org/api/idtoken")// validateJWTFromAppEngine validates a JWT found in the// "x-goog-iap-jwt-assertion" header.funcvalidateJWTFromAppEngine(wio.Writer,iapJWT,projectNumber,projectIDstring)error{// iapJWT := "YmFzZQ==.ZW5jb2RlZA==.and0" // req.Header.Get("X-Goog-IAP-JWT-Assertion")// projectNumber := "123456789"// projectID := "your-project-id"ctx:=context.Background()aud:=fmt.Sprintf("/projects/%s/apps/%s",projectNumber,projectID)payload,err:=idtoken.Validate(ctx,iapJWT,aud)iferr!=nil{returnfmt.Errorf("idtoken.Validate: %w",err)}// payload contains the JWT claims for further inspection or validationfmt.Fprintf(w,"payload: %v",payload)returnnil}// validateJWTFromComputeEngine validates a JWT found in the// "x-goog-iap-jwt-assertion" header.funcvalidateJWTFromComputeEngine(wio.Writer,iapJWT,projectNumber,backendServiceIDstring)error{// iapJWT := "YmFzZQ==.ZW5jb2RlZA==.and0" // req.Header.Get("X-Goog-IAP-JWT-Assertion")// projectNumber := "123456789"// backendServiceID := "backend-service-id"ctx:=context.Background()aud:=fmt.Sprintf("/projects/%s/global/backendServices/%s",projectNumber,backendServiceID)payload,err:=idtoken.Validate(ctx,iapJWT,aud)iferr!=nil{returnfmt.Errorf("idtoken.Validate: %w",err)}// payload contains the JWT claims for further inspection or validationfmt.Fprintf(w,"payload: %v",payload)returnnil}

importcom.google.api.client.http.HttpRequest;importcom.google.api.client.json.webtoken.JsonWebToken;importcom.google.auth.oauth2.TokenVerifier;/** Verify IAP authorization JWT token in incoming request. */publicclassVerifyIapRequestHeader{privatestaticfinalStringIAP_ISSUER_URL="https://cloud.google.com/iap";// Verify jwt tokens addressed to IAP protected resources on App Engine.// The project *number* for your Google Cloud project via 'gcloud projects describe $PROJECT_ID'// The project *number* can also be retrieved from the Project Info card in Cloud Console.// projectId is The project *ID* for your Google Cloud Project.booleanverifyJwtForAppEngine(HttpRequestrequest,longprojectNumber,StringprojectId)throwsException{// Check for iap jwt header in incoming requestStringjwt=request.getHeaders().getFirstHeaderStringValue("x-goog-iap-jwt-assertion");if(jwt==null){returnfalse;}returnverifyJwt(jwt,String.format("/projects/%s/apps/%s",Long.toUnsignedString(projectNumber),projectId));}booleanverifyJwtForComputeEngine(HttpRequestrequest,longprojectNumber,longbackendServiceId)throwsException{// Check for iap jwt header in incoming requestStringjwtToken=request.getHeaders().getFirstHeaderStringValue("x-goog-iap-jwt-assertion");if(jwtToken==null){returnfalse;}returnverifyJwt(jwtToken,String.format("/projects/%s/global/backendServices/%s",Long.toUnsignedString(projectNumber),Long.toUnsignedString(backendServiceId)));}privatebooleanverifyJwt(StringjwtToken,StringexpectedAudience){TokenVerifiertokenVerifier=TokenVerifier.newBuilder().setAudience(expectedAudience).setIssuer(IAP_ISSUER_URL).build();try{JsonWebTokenjsonWebToken=tokenVerifier.verify(jwtToken);// Verify that the token contain subject and email claimsJsonWebToken.Payloadpayload=jsonWebToken.getPayload();returnpayload.getSubject()!=null &&payload.get("email")!=null;}catch(TokenVerifier.VerificationExceptione){System.out.println(e.getMessage());returnfalse;}}}

/** * TODO(developer): Uncomment these variables before running the sample. */// const iapJwt = 'SOME_ID_TOKEN'; // JWT from the "x-goog-iap-jwt-assertion" headerletexpectedAudience=null;if(projectNumber &&projectId){// Expected Audience for App Engine.expectedAudience=`/projects/${projectNumber}/apps/${projectId}`;}elseif(projectNumber &&backendServiceId){// Expected Audience for Compute EngineexpectedAudience=`/projects/${projectNumber}/global/backendServices/${backendServiceId}`;}constoAuth2Client=newOAuth2Client();asyncfunctionverify(){// Verify the id_token, and access the claims.constresponse=awaitoAuth2Client.getIapPublicKeys();constticket=awaitoAuth2Client.verifySignedJwtWithCertsAsync(iapJwt,response.pubkeys,expectedAudience,['https://cloud.google.com/iap'],);// Print out the info contained in the IAP ID tokenconsole.log(ticket);}verify().catch(console.error);

namespace Google\Cloud\Samples\Iap;# Imports Google auth libraries for IAP validationuse Google\Auth\AccessToken;/** * Validate a JWT passed to your App Engine app by Identity-Aware Proxy. * * @param string $iapJwt The contents of the X-Goog-IAP-JWT-Assertion header. * @param string $cloudProjectNumber The project *number* for your Google *     Cloud project. This is returned by 'gcloud projects describe $PROJECT_ID', *     or in the Project Info card in Cloud Console. * @param string $cloudProjectId Your Google Cloud Project ID. */function validate_jwt_from_app_engine(    string $iapJwt,    string $cloudProjectNumber,    string $cloudProjectId): void {    $expectedAudience = sprintf(        '/projects/%s/apps/%s',        $cloudProjectNumber,        $cloudProjectId    );    validate_jwt($iapJwt, $expectedAudience);}/** * Validate a JWT passed to your Compute / Container Engine app by Identity-Aware Proxy. * * @param string $iapJwt The contents of the X-Goog-IAP-JWT-Assertion header. * @param string $cloudProjectNumber The project *number* for your Google *     Cloud project. This is returned by 'gcloud projects describe $PROJECT_ID', *     or in the Project Info card in Cloud Console. * @param string $backendServiceId The ID of the backend service used to access the *     application. See https://cloud.google.com/iap/docs/signed-headers-howto *     for details on how to get this value. */function validate_jwt_from_compute_engine(    string $iapJwt,    string $cloudProjectNumber,    string $backendServiceId): void {    $expectedAudience = sprintf(        '/projects/%s/global/backendServices/%s',        $cloudProjectNumber,        $backendServiceId    );    validate_jwt($iapJwt, $expectedAudience);}/** * Validate a JWT passed to your app by Identity-Aware Proxy. * * @param string $iapJwt The contents of the X-Goog-IAP-JWT-Assertion header. * @param string $expectedAudience The expected audience of the JWT with the following formats: *     App Engine:     /projects/{PROJECT_NUMBER}/apps/{PROJECT_ID} *     Compute Engine: /projects/{PROJECT_NUMBER}/global/backendServices/{BACKEND_SERVICE_ID} */function validate_jwt(string $iapJwt, string $expectedAudience): void{    // Validate the signature using the IAP cert URL.    $token = new AccessToken();    $jwt = $token->verify($iapJwt, [        'certsLocation' => AccessToken::IAP_CERT_URL    ]);    if (!$jwt) {        print('Failed to validate JWT: Invalid JWT');        return;    }    // Validate token by checking issuer and audience fields.    assert($jwt['iss'] == 'https://cloud.google.com/iap');    assert($jwt['aud'] == $expectedAudience);    print('Printing user identity information from ID token payload:');    printf('sub: %s', $jwt['sub']);    printf('email: %s', $jwt['email']);}

fromgoogle.auth.transportimportrequestsfromgoogle.oauth2importid_tokendefvalidate_iap_jwt(iap_jwt,expected_audience):"""Validate an IAP JWT.    Args:      iap_jwt: The contents of the X-Goog-IAP-JWT-Assertion header.      expected_audience: The Signed Header JWT audience. See          https://cloud.google.com/iap/docs/signed-headers-howto          for details on how to get this value.    Returns:      (user_id, user_email, error_str).    """try:decoded_jwt=id_token.verify_token(iap_jwt,requests.Request(),audience=expected_audience,certs_url="https://www.gstatic.com/iap/verify/public_key",)return(decoded_jwt["sub"],decoded_jwt["email"],"")exceptExceptionase:return(None,None,f"**ERROR: JWT validation error{e}**")

# iap_jwt = "The contents of the X-Goog-Iap-Jwt-Assertion header"# project_number = "The project *number* for your Google Cloud project"# project_id = "Your Google Cloud project ID"# backend_service_id = "Your Compute Engine backend service ID"require"googleauth"audience=nilifproject_number &&project_id# Expected audience for App Engineaudience="/projects/#{project_number}/apps/#{project_id}"elsifproject_number &&backend_service_id# Expected audience for Compute Engineaudience="/projects/#{project_number}/global/backendServices/#{backend_service_id}"end# The client ID as the target audience for IAPpayload=Google::Auth::IDTokens.verify_iapiap_jwt,aud:audienceputspayloadifaudience.nil?puts"Audience not verified! Supply a project_number and project_id to verify"end