Assymmetric key validation should have to use private key file
- Dominant language
- Go
- Stars
- 3k
- Forks
- 387
- Avg merge
- 4h 16m
- Merged PRs (30d)
- 1
Description
I am trying to implement an asymmetric validation middleware that uses RS256. In theory this should only need the public key to verify the JWT, but not including the private key does not work. I do not want to include the private key with the project. Below is my implementation.
`
authMiddleware, _ := app.New(&app.GinJWTMiddleware {
Realm: "zone",
SigningAlgorithm: "RS256",
PrivKeyFile: "keys/jwtRS256.key",
PubKeyFile: "keys/jwtRS256.key.pub",
PayloadFunc: func(data interface{}) app.MapClaims {
if v, ok := data.(*JWTToken); ok {
return app.MapClaims{
userName: v.UserName,
}
}
return app.MapClaims{}
},
IdentityHandler: func(c *gin.Context) interface{} {
claims := app.ExtractClaims(c)
return &JWTToken{
UserName: claims[userName].(string),
TokenType: claims[tokenType].(string),
}
},
Authorizator: func(data interface{}, c *gin.Context) bool {
if v, ok := data.(*JWTToken); ok && v.UserName == "admin" {
return true
}
return false
},
Unauthorized: func(c *gin.Context, code int, message string) {
c.JSON(code, gin.H{
"code": code,
"message": message,
})
},
TokenLookup: "header: Authorization, query: token, cookie: jwt",
TokenHeadName: "Bearer",
TimeFunc: time.Now,
})`
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the app.New GinJWTMiddleware configuration shown in the issue and reproduce RS256 validation with only PubKeyFile configured. Trace how the middleware loads and uses the key files during validation; the issue is complete when public-key-only verification works without requiring the private key file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100