jwt
jwt copied to clipboard
Adding canonical `Keyfunc` functions for RSA, ECDSA, EdDSA and HMAC
This PR adds ready-to-use keyfunc functions for the various signing methods. This should simplify a lot of standard use-cases and also includes a proper signing method check.
This allows for a much cleaner experience in probably 90% of all use cases:
token, err := jwt.ParseWithClaims(
tokenString, &MyCustomClaims{},
jwt.PresharedKey([]byte("AllYourBase")),
jwt.WithLeeway(5*time.Second),
)
token, err := jwt.ParseWithClaims(
tokenString, &MyCustomClaims{},
jwt.RSAPublicKey(myKey),
jwt.WithAudience("http://example.com"),
)
I've gone back-forth on this PR. On one hand, it's a nice quality of life improvement for the most common use cases.
On the other hand, the caller needs to decide whether to use this helper function or pass their own function, using the exported structs and calling
.Alg()
.Also, I've often needed access to the header bits for additional validation, refresh, etc. and so always constructed this myself.
Not against this, just want to make sure we're expanding the API surface area where it makes sense.
Yeah same here, the main reason for this was because we had a lot of issues that were not sure how to pass public/private keys properly. This is now somewhat mitigated by the documentation page. I still think it's a nice, clean way of using this library, though.
Maybe we can keep it as "approved", but not merge it yet and aim for a 5.1 release.
Closing this in favour of external libraries, such as https://github.com/MicahParks/keyfunc