Extending JWT claims validation to support other claims
- Dominant language
- Erlang
- Stars
- 7k
- Forks
- 1.1k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 9
Description
Based on [source](https://github.com/apache/couchdb/blob/main/src/jwtf/src/jwtf.erl), I understand only limited number of JWT claims can be validated. Trying to validate other claims result in error `unknown_checks`.
I would like to ask for introducing validation any provided claim.
In my case, I use an SSO of a huge Organisation, where many users can define their own applications/clients (signed with same SSO key). Without validating `aud`, anyone could create another application with roles that my CouchDB instance accepts.
## Desired Behaviour
When provided a config like below, the claim `aud` should be verified: both if it exists and if it matched provided `my-application` value.
`required_claims = exp, {aud, "my-application"}`
I believe it's worth allowing such a validation for any custom claim (only to check existence and value matching, if provided).
## Possible Solution
I believe the [source](https://github.com/apache/couchdb/blob/main/src/jwtf/src/jwtf.erl) should not limit the check only to claims specified in line 45. There could be a function providing a "general" claim check, no matter what it is exactly.
Contributor guide
Research direction
Start with src/jwtf/src/jwtf.erl, especially the claim checks referenced at line 45, and review how required_claims is parsed. The change is complete when a configuration such as required_claims = exp, {aud, "my-application"} validates aud for existence and the supplied value, while supporting other provided claims without unknown_checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- erlang
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100