jwt icon indicating copy to clipboard operation
jwt copied to clipboard

Validation Options - Experiment 1: Embedding validation options in claim

Open oxisto opened this issue 2 years ago • 0 comments

This PR is part of a series of experiments, to see which options we have to implement validation options in a backwards compatible way. I want to get a fell about our options first and some feedback from the community, before we implement all desired options. I am looking to gather feedback here: https://github.com/golang-jwt/jwt/discussions/211

Option 1 is to embedded a validator struct which olds all the necessary information into the claims itself. It is populated by the Parser during Parse. The claim's Valid function can then retrieve the information and adjust the validation.

Pros:

  • Keeps everything as is on the outside, no changes to the exported Valid or VerifyXXX functions, not even with varargs.
  • Pretty simple to use for the user I guess
  • The variable is unexported in the claims itself (v) and should therefore not interfere with json Marshalling

Cons:

  • can only work with jwt.RegisteredClaims (and jwt.StandardClaims) because I have no way to "silently" inject it into MapClaims. I could add a key to the map, but this will be then transparent to the user and might conflict with a custom claim the user has
  • The way the current test is structured in parser_test.go I cannot really test it because it is using the jwt_test package for tests and therefore cannot access the unexpected v field and this leads to some errors in the comparison test.

oxisto avatar May 28 '22 19:05 oxisto

Closing this for now as we are preparing for a new v5 api-breaking solution.

oxisto avatar Aug 27 '22 10:08 oxisto