kong-upstream-jwt
kong-upstream-jwt copied to clipboard
Missing claim for `ngx.ctx.authenticated_consumer`
It is more important to sign the data that kong has derived, and therefore is the authoritative source for; than signing the untrusted data that was passed into the http request. Additionally, it seems like ngx.ctx.authenticated_consumer
was intended to be used, as it's specified here:
https://github.com/Optum/kong-upstream-jwt/blob/master/src/handler.lua#L9
Would you support a PR that added a config to enable ngx.ctx.authenticated_consumer
to be added as a claim in the jwt?
Alternatively, a more generic solution may be to allow users to configure a set of headers to be added to claims, some previous discussion here: https://github.com/Optum/kong-upstream-jwt/issues/15 https://github.com/Optum/kong-upstream-jwt/pull/16
Would you support a PR that implemented an optional additional_header_claims
config that allowed custom headers to be added?
Let me know what you think, I would love to help support