mercure icon indicating copy to clipboard operation
mercure copied to clipboard

Published 20 hours ago • verified publisher icon dunglas

Switch from golang-jwt/jwt to go-jose/go-jose

Open dunglas opened this issue 1 year ago • 1 comments

https://github.com/go-jose/go-jose has the benefit of natively supporting JWK (#470, #813) and of being already a dependency of Caddy (so we don't bloat the final binary).

WDYT @broncha?

dunglas avatar Dec 20 '23 17:12 dunglas

@dunglas looks like go-jose only support jwks as string (I may be wrong, I just had a quick look). So we would need to handle the fetching and caching the keys from the provided URL.

broncha avatar Dec 22 '23 07:12 broncha

Hi @dunglas I might be able to give this time in coming weeks. Been super busy!

broncha avatar Mar 18 '24 13:03 broncha

@broncha it looks like go-jose isn't gaining traction while go-jwt is actively maintained and JWK/JWKS support can easily be added with the keyfunc function. Let's stay with go-jwt!

I did the upgrade to go-jwt v5 in #262.

dunglas avatar Mar 18 '24 13:03 dunglas