Added algorithm option to jwt policy #999
Conversation
Codecov Report
|
|
The tests failing in these pipelines, failed once(with the same timeout error) locally for me, but have since passed. Is there a way to re-try these pipelines? |
|
I can take care of this and make sure all tests pass. Can you rebase with latest master? |
Brady-Conn
force-pushed
the
jwt-algorithm-options
branch
from
faf9712 to
bccffbf
Compare
|
Awesome, thank you. I just pushed up that rebase, let me know if there is anything else I can do. |
| @@ -38,6 +38,10 @@ module.exports = { | |||
| type: 'boolean', | |||
| default: true, | |||
| description: 'Value istructing the gateway whether verify the sub against the internal SOC' | |||
| }, | |||
| algorithms: { | |||
| type: 'array', | |||
There was a problem hiding this comment.
I think we should probably specify the items to be a string and then enum the possible choice. JWT has a fixed set of algorithms
There was a problem hiding this comment.
That makes sense, I just pushed up a change to reflect that. I wasn't 100% sure about the syntax so let me know if I need to modify it at all.
Brady-Conn
force-pushed
the
jwt-algorithm-options
branch
from
8a957db to
954df8f
Compare
Brady-Conn
force-pushed
the
jwt-algorithm-options
branch
from
954df8f to
7ae36e8
Compare
…ptions Added algorithm option to jwt policy
Hello,
Express-gateway is fantastic — it has become the backbone of our team’s api architecture. That being said, we have run into one small issue.
Problem: The JWT policy does not currently accept algorithms as an option to specify which algorithms can be used to verify tokens. Under the hood I noticed express-gateway uses
passport-jwt, which usesjsonwebtoken. This is the same package we use. Bothpassport-jwtandjsonwebtokensupport specifying algorithms. This is a good feature because otherwise jsonwebtoken will allow any algorithm to be used depending on what is decoded via the JWT header. Specifying algorithms allows enforcing of standards across our apis.Solution: Expose the algorithms option in the JWT policy.
Here is the pr for the docs update: ExpressGateway/express-gateway.io#336