go-zero icon indicating copy to clipboard operation
go-zero copied to clipboard

bug: when jwt payload defined key was in Reserved claims,middleware contex().value will not work

Open czyt opened this issue 3 years ago • 2 comments

when define a jwt payload,and its key in

The JWT specification defines seven reserved claims that are not required, but are recommended to allow interoperability with third-party applications. These are:

iss (issuer): Issuer of the JWT

sub (subject): Subject of the JWT (the user)

aud (audience): Recipient for which the JWT is intended

exp (expiration time): Time after which the JWT expires

nbf (not before time): Time before which the JWT must not be accepted for processing

iat (issued at time): Time at which the JWT was issued; can be used to determine age of the JWT

jti (JWT ID): Unique identifier; can be used to prevent the JWT from being replayed (allows a token to be used only once)

for example a payload eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb21haW4iOiI2MmM1NDU1ZWEwMDFmNzgyZTQzY2MxYmYiLCJleHBpcmF0aW9uIjoxNjU3MTY3MjM4LCJzdWIiOiJtYW5hZ2VyIiwidXNlcl9pZCI6IjYyYzQwZTdhZmI1YzMxZDlkZTljYWRlNCJ9.oLwuKAC1Gq7kQIKy-VePHo_E4HgmF_NBq9V6qbdIaC4 which decoded is

{
  "domain": "62c5455ea001f782e43cc1bf",
  "expiration": 1657162133,
  "sub": "manager",
  "user_id": "62c40e7afb5c31d9de9cade4"
}

cannot get the sub value from middleware via request Context().Value("sub")

czyt avatar Jul 07 '22 03:07 czyt

I looked at go-zero's wrapping of the jwt code and the 7 reserved declarations of jwt were ignored, here is the source code

MiHuaaaaaaaa avatar Jul 15 '22 08:07 MiHuaaaaaaaa

@kevwan @anqiansong is it nessary to keep the 7 reserved declarations of jwt?for what case?

czyt avatar Jul 19 '22 01:07 czyt

This issue is stale because it has been open for 30 days with no activity.

github-actions[bot] avatar Aug 18 '22 02:08 github-actions[bot]

Because it's not user defined data.

kevwan avatar Aug 18 '22 14:08 kevwan