Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New validation API #236

Merged
merged 12 commits into from Dec 5, 2022
Merged

New validation API #236

merged 12 commits into from Dec 5, 2022

Commits on Aug 28, 2022

  1. New Validation API

    Some guidelines in designing the new validation API
    
    * Previously, the `Valid` method was placed on the claim, which was always not entirely semantically correct, since the validity is concerning the token, not the claims. Although the validity of the token is based on the processing of the claims (such as `exp`). Therefore, the function `Valid` was removed from the `Claims` interface and the single canonical way to retrieve the validity of the token is to retrieve the `Valid` property of the `Token` struct.
    * The previous fact was enhanced by the fact that most claims implementations had additional exported `VerifyXXX` functions, which are now removed
    * All validation errors should be comparable with `errors.Is` to determine, why a particular validation has failed
    * Developers want to adjust validation options. Popular options include:
      * Leeway when processing exp, nbf, iat
      * Not verifying `iat`, since this is actually just an informational claim. When purely looking at the standard, this should probably the default
      * Verifying `aud` by default, which actually the standard sort of demands. We need to see how strong we want to enforce this
    * Developers want to create their own claim types, mostly by embedding one of the existing types such as `RegisteredClaims`.
      * Sometimes there is the need to further tweak the validation of a token by checking the value of a custom claim. Previously, this was possibly by overriding `Valid`. However, this was error-prone, e.g., if the original `Valid` was not called. Therefore, we should provide an easy way for *additional* checks, without by-passing the necessary validations
    
    This leads to the following two major changes:
    
    * The `Claims` interface now represents a set of functions that return the mandatory claims represented in a token, rather than just a `Valid` function. This is also more semantically correct.
    * All validation tasks are offloaded to a new (optional) `Validator`, which can also be configured with appropriate options. If no custom validator was supplied, a default one is used.
    oxisto committed Aug 28, 2022
    Configuration menu
    Copy the full SHA
    dc52415 View commit details
    Browse the repository at this point in the history
  2. Fixed linting errors

    oxisto committed Aug 28, 2022
    Configuration menu
    Copy the full SHA
    066f850 View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    0e79f91 View commit details
    Browse the repository at this point in the history
  4. Configuration menu
    Copy the full SHA
    4990d2c View commit details
    Browse the repository at this point in the history
  5. Configuration menu
    Copy the full SHA
    eedf3eb View commit details
    Browse the repository at this point in the history

Commits on Oct 15, 2022

  1. Apply suggestions from code review

    Co-authored-by: Micah Parks <66095735+MicahParks@users.noreply.github.com>
    oxisto and MicahParks committed Oct 15, 2022
    Configuration menu
    Copy the full SHA
    91f51d0 View commit details
    Browse the repository at this point in the history

Commits on Oct 26, 2022

  1. More documentation

    oxisto committed Oct 26, 2022
    Configuration menu
    Copy the full SHA
    06a12c1 View commit details
    Browse the repository at this point in the history
  2. exported CustomClaims

    oxisto committed Oct 26, 2022
    Configuration menu
    Copy the full SHA
    2281dd9 View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    5d57c29 View commit details
    Browse the repository at this point in the history
  4. Configuration menu
    Copy the full SHA
    5a65c47 View commit details
    Browse the repository at this point in the history

Commits on Dec 4, 2022

  1. Simplified Validation API

    oxisto committed Dec 4, 2022
    Configuration menu
    Copy the full SHA
    1d6e6dc View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    2036f52 View commit details
    Browse the repository at this point in the history