Split session #25
Split session #25
Conversation
david-littlefarmer
left a comment
david-littlefarmer
left a comment
There was a problem hiding this comment.
Do i understand it right, that on every request we create new JWT verifier and check the token against it?
If so, then why not to predefine them for exmaple in array and just try to iterate through them, until the one of them is successful since the private and/or public keys are defined on startup of server.
Also can you please describe some simple flow of verifier? I find it confusing.
klaidliadon
force-pushed
the
split-session
branch
from
7ff1c5c to
d1a1668
Compare
VojtechVitek
left a comment
VojtechVitek
left a comment
There was a problem hiding this comment.
Great, this is getting better!
| } | ||
|
|
||
| func Session(cfg Options) func(next http.Handler) http.Handler { | ||
| func VerifyToken(cfg Options) func(next http.Handler) http.Handler { |
There was a problem hiding this comment.
I feel like we could split Options struct into two types -- one for Verifier and one for Sessions.
There was a problem hiding this comment.
Imho, this middleware needs nothing but JWTSecret and ErrHandler. It should always verify HS256 JWT from both Authorization header and Cookie.
I don't see the need for AuthProvider interface. Is it useful for anything else? I think it just locks us down to this implementation -- switching algorithms, jwks or supporting secret rotation or multiple algorithms would be more difficult.
There was a problem hiding this comment.
Imho, stack/api's ProjectJWTVerifier should be a a separate implementation that doesn't have anything in common with this Verifier except for passing the token into context via ctx = jwtauth.NewContext(ctx, token, nil)
| } | ||
| } | ||
|
|
||
| func Session(cfg Options) func(next http.Handler) http.Handler { |
There was a problem hiding this comment.
Session needs ErrorHandler, UserStore and a way to fetch AccessKey.
klaidliadon
force-pushed
the
split-session
branch
from
34dbc3e to
30ad26a
Compare
proto/authcontrol.ridl
Outdated
| webrpc = v1 | ||
|
|
||
| name = access-control | ||
| name = auth-control |
There was a problem hiding this comment.
| name = auth-control | |
| name = authcontrol |
Split session and verify middleware.
JWT Auth is created by an interface, which has two implementations: