Comments (3)
I mostly set a default because it seems like the most common algorithm is HS256
, which would allow most users to avoid having to add an extra flag.
Has the industry moved onto a different algorithm by default? Maybe we can error if the algorithm doesn't match, rather than continue to decode? I think that might be a good middle ground solution which helps everyone. What do you think?
from jwt-cli.
From my experience, asymmetric algorithms like PS512
and PS512
are very common (and an absolute must) in scenarios where the authorization server and the resource server are not operated by the same entity. This article gives a great overview over asymmetric algorithms in the context of JWTs.
In general, being aware of the choice of algorithms for signature validation is a good thing. However, setting sane defaults is a good thing, too. With #133, the new warning message provides useful feedback when the algorithms didn't match:
The JWT provided has a different signing algorithm ({:?}) than the one selected for validation ({:?}){/$}
Maybe the actual value of this change is the ability to provide a list of algorithms for signature validation. This is very useful when multiple variations of the same algorithm (e.g. PS256
, PS384
and PS512
) should be accepted.
To cut a long story short, I think we can also add the HSxxx algorithms as a default choice when #133 is merged. Would that be in your interest?
Arg::with_name("algorithms")
.help("a comma-separated list of algorithms to be used for signature validation. All algorithms need to be of the same family (HMAC, RSA, EC).")
+ .default_value("HS512,HS384,HS256")
.takes_value(true)
.long("algs")
.short("A")
.possible_values(&SupportedAlgorithms::variants())
from jwt-cli.
@codedust that works for me, I think
from jwt-cli.
Related Issues (20)
- GoFish has been abandoned and documentation about it in the README should be removed HOT 2
- Feature Request: Support plaintext payload HOT 1
- Tests not in `main_test.rs' don't run HOT 1
- Unsecured JWT HOT 4
- `--secret` flag treats all values as file paths HOT 4
- Feature Request: encode allow none `typ` HOT 2
- linux binary for jwt 5.0.3 does not run on CentOS 7 HOT 8
- Add support for TTL when generating JWTs HOT 3
- Improve documentation for using elliptic curve keys HOT 1
- Allow the `typ` header field to have values other than `JWT` HOT 1
- encode always errors with "Invalid JSON provided!" on 6.0.0 HOT 2
- Bug: Error running on Fedora Linux in Docker on Apple ARM silicon HOT 1
- missing ES512 HOT 1
- Bump jsonwebtoken to v8.3.0 to v9.x.x HOT 2
- bug: not able to use in macOS for Apple Silicon chip HOT 7
- Brew formula does not work with linuxbrew HOT 2
- Shell completion
- App crash on `jwt encode` command with `@` in secret HOT 1
- Error: version `GLIBC_2.33' not found HOT 1
- Add option to ignore alg type HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jwt-cli.