func (s *Authenticator) validateUserCookieValue(remoteCookieValue string) (string, error) {
	inboundJWT := authNCookieJWT{}
	if len(remoteCookieValue) < 1 {
		s.logger.Printf("Invalid cookie value (too small)")
		return "", nil
	}
	tok, err := jwt.ParseSigned(remoteCookieValue)
	if err != nil {
		s.logger.Printf("Invalid cookie value(jwt) (%s)", err)
		return "", nil
	}
	if err := s.JWTClaims(tok, &inboundJWT); err != nil {
		s.logger.Printf("error validating JWT claims err: %s\n", err)
		// TODO: this path could have fatal errors, need to take this into account
		// to avoid a potential redirect loop.
		return "", nil
	}
	// At this point we know the signature is valid, but now we must
	// validate the contents of the JWT token
	issuer := s.appName
	subject := "state:" + AuthCookieName
	if inboundJWT.Issuer != issuer || inboundJWT.Subject != subject ||
		inboundJWT.NotBefore > time.Now().Unix() || inboundJWT.Expiration < time.Now().Unix() {
		s.logger.Printf("invalid JWT values")
		return "", nil
	}
	username := inboundJWT.Username
	if len(username) < 1 {
		return "", errors.New("bad cookie Vauue state")
	}
	return inboundJWT.Username, nil

}
// validateUserCookieValue returns "" if no or bad username, returns non-nil error for fatal errors only
validateUserCookieValue returns "" if no or bad username, returns non-nil error for fatal errors only
// validateUserCookieValue returns " " if no or bad username returns non - nil error for fatal errors only
func (s *Authenticator) validateUserCookieValue(remoteCookieValue string) (string, error) {
	inboundJWT := authNCookieJWT{}
	if len(remoteCookieValue) < 1 {
		s.logger.Printf("Invalid cookie value (too small)")
		return "", nil
	}
	tok, err := jwt.ParseSigned(remoteCookieValue)
	if err != nil {
		s.logger.Printf("Invalid cookie value(jwt) (%s)", err)
		return "", nil
	}
	if err := s.JWTClaims(tok, &inboundJWT); err != nil {
		s.logger.Printf("error validating JWT claims err: %s\n", err)
		return "", nil
	}
	issuer := s.appName
	subject := "state:" + AuthCookieName
	if inboundJWT.Issuer != issuer || inboundJWT.Subject != subject ||
		inboundJWT.NotBefore > time.Now().Unix() || inboundJWT.Expiration < time.Now().Unix() {
		s.logger.Printf("invalid JWT values")
		return "", nil
	}
	username := inboundJWT.Username
	if len(username) < 1 {
		return "", errors.New("bad cookie Vauue state")
	}
	return inboundJWT.Username, nil
}
func ( s * Authenticator ) validateUserCookieValue ( remoteCookieValue string ) ( string , error ) { inboundJWT := authNCookieJWT { } if len ( remoteCookieValue ) < 1 { s . logger . Printf ( " " ) return " " , nil } tok , err := jwt . ParseSigned ( remoteCookieValue ) if err != nil { s . logger . Printf ( " " , err ) return " " , nil } if err := s . JWTClaims ( tok , & inboundJWT ) ; err != nil { s . logger . Printf ( " \n " , err ) return " " , nil } issuer := s . appName subject := " " + AuthCookieName if inboundJWT . Issuer != issuer || inboundJWT . Subject != subject || inboundJWT . NotBefore > time . Now ( ) . Unix ( ) || inboundJWT . Expiration < time . Now ( ) . Unix ( ) { s . logger . Printf ( " " ) return " " , nil } username := inboundJWT . Username if len ( username ) < 1 { return " " , errors . New ( " " ) } return inboundJWT . Username , nil }
validateUserCookieValue returns "" if no or bad username, returns non-nil error for fatal errors only
validateUserCookieValue returns " " if no or bad username returns non - nil error for fatal errors only
// TODO: this path could have fatal errors, need to take this into account // to avoid a potential redirect loop. // At this point we know the signature is valid, but now we must // validate the contents of the JWT token