PostQuantum.Jwt.Analyzers 1.0.0 

dotnet add package PostQuantum.Jwt.Analyzers --version 1.0.0
                    


                    

                
NuGet\Install-Package PostQuantum.Jwt.Analyzers -Version 1.0.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="PostQuantum.Jwt.Analyzers" Version="1.0.0">
  <PrivateAssets>all</PrivateAssets>
  <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
</PackageReference>
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="PostQuantum.Jwt.Analyzers" Version="1.0.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="PostQuantum.Jwt.Analyzers">
  <PrivateAssets>all</PrivateAssets>
  <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
</PackageReference>
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add PostQuantum.Jwt.Analyzers --version 1.0.0
                    


                    

                
#r "nuget: PostQuantum.Jwt.Analyzers, 1.0.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package PostQuantum.Jwt.Analyzers@1.0.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=PostQuantum.Jwt.Analyzers&version=1.0.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=PostQuantum.Jwt.Analyzers&version=1.0.0
                    


                            Install as a Cake Tool

PostQuantum.Jwt.Analyzers

Compile-time enforcement of PostQuantum.Jwt's fail-closed architecture. Because the library deliberately breaks classical JWT conventions (single ML-DSA-65 suite, header ignored for key selection), generic JWT linters don't fit — these analyzers encode the library's actual rules.

Production-quality library for controlled systems — not independently audited (a permanent, documented limitation).

Install

<PackageReference Include="PostQuantum.Jwt.Analyzers" Version="1.0.0" PrivateAssets="all" />

PrivateAssets="all" keeps the analyzer a build-time-only dependency (it never flows to your package's consumers).

Rules

ID Severity Flags
PQJWT001 Error Reading a JOSE header field (alg, jwk, jku, x5u, x5c) from a System.Text.Json JsonElement.GetProperty/TryGetProperty or JsonNode/JsonObject indexer. The verification key comes from a trusted key ring keyed by kid, never the token header — inspecting the header reintroduces algorithm-confusion and jwk/jku key-injection attacks. Call PqJwtValidator.Validate(...) instead.
PQJWT002 Warning new PqJwtValidator(...).Validate(...) — constructing a validator per call. It's immutable and thread-safe; cache one instance (a field, singleton, or DI registration).

Both rules are semantic (type-aware), so they don't fire on unrelated JSON or on the correct singleton/DI patterns.

Tuning severity

Adjust per project in .editorconfig:

# Relax PQJWT001 to a warning, or elevate PQJWT002 to an error
dotnet_diagnostic.PQJWT001.severity = warning
dotnet_diagnostic.PQJWT002.severity = error

Suppress a single justified case with #pragma warning disable PQJWT001 or [SuppressMessage("Security", "PQJWT001")].

To God be the glory — 1 Corinthians 10:31.

There are no supported framework assets in this package.

Learn more about Target Frameworks and .NET Standard.

This package has no dependencies.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
1.0.0 110 6/30/2026
1.0.0-preview.10 66 6/6/2026
1.0.0-preview.9 66 6/6/2026
1.0.0-preview.8 71 6/5/2026
1.0.0-preview.7 64 6/5/2026
1.0.0-preview.6 60 6/4/2026
1.0.0-preview.5 62 6/3/2026
1.0.0-preview.3 73 6/2/2026
1.0.0-preview.2 61 6/2/2026