jwt
jwt copied to clipboard
golang-jwt
Bring over ValidationHelper functionality from v4 branch
The v4 branch has a nice validation helper struct which combines a lot of the functionality of the Validate functions. It might be nice to re-implement that and slowly move existing functionality to it.
This would include things that have been on the wishlist in other forks, such as having leeway when validating timestamps (see https://github.com/form3tech-oss/jwt-go/pull/12).
I was wondering about the implementation of the leeway: Why does the incorporation of leeway depend on the validating server instead of the authorizing client? To me, it seems like it would be cleaner for the JWT to be the source of truth, with leeway built into the iat/exp
Just ran into the "token used before issued" error today for the first time, after things had been working fine previously.
The discussion at https://github.com/golang-jwt/jwt/issues/98 referenced this issue. Are there any plans to implement it and disregard the pre-IAT check?
Just ran into the "token used before issued" error today for the first time, after things had been working fine previously.
The discussion at #98 referenced this issue. Are there any plans to implement it and disregard the pre-IAT check?
In a world with infinite time, yes :) Currently I am waiting for https://github.com/golang-jwt/jwt/pull/108 to be merged. This one will be next.
I had a quick look yesterday and I am not sure if we can port this over in a backwards compatible manner, since the interface of Claims needs to be changed. Especially the Valid function needs to have an additional parameter for the ValidationHelper. I guess I will first focus on the functionality and then see whether we can port this to v4 or if this will then introduce a v5 branch with breaking changes.
This is something we relied on from the old library as we ran on the preview version and would help us move to adopt this port.
Yes, we also rely in this functionality from the old library :)
@oxisto , regarding your statement below:
I guess I will first focus on the functionality and then see whether we can port this to v4 or if this will then introduce a v5 branch with breaking changes.
So, what are the intended functionality that are targeted in v4.x?
Please see https://github.com/golang-jwt/jwt/discussions/211 for an ongoing discussion how to proceed.