Authenticator and PrivateKey should not be required by default
- Dominant language
- Go
- Stars
- 3k
- Forks
- 387
- Avg merge
- 4h 16m
- Merged PRs (30d)
- 1
Description
Authenticator function and private key are required now if you want to use this middleware in a Gin project. But sometimes your application does not issue JWT-tokens, refresh and destroy them (especially in a microservice architecture where this functions usually do a separate service), but only needs an ability to read the token and extract claims from it. In such a case you just should provide a public file and encryption algorithm name. For example, Echo framework jwt-middleware could be created with only public key and algo name (see https://echo.labstack.com/middleware/jwt/):
```
jwtConfig := middleware.JWTConfig{
SigningKey: publicKey,
SigningMethod: jwt.SigningMethodRS256.Name,
}
```
I believe that this middleware also should require only minimum for tokens parsing.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the middleware configuration and token-parsing path, focusing on how Authenticator, private key, public file, and encryption algorithm are validated. Done means a Gin application can omit Authenticator and private key while providing a public key and algorithm to read tokens and extract claims, without breaking existing token-issuing behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100