appleboy / appleboy/gin-jwt

Authenticator and PrivateKey should not be required by default

Open
#274 1 comment 3 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
3k
Forks
387
Avg merge
4h 16m
Merged PRs (30d)
1

Description

Authenticator function and private key are required now if you want to use this middleware in a Gin project. But sometimes your application does not issue JWT-tokens, refresh and destroy them (especially in a microservice architecture where this functions usually do a separate service), but only needs an ability to read the token and extract claims from it. In such a case you just should provide a public file and encryption algorithm name. For example, Echo framework jwt-middleware could be created with only public key and algo name (see https://echo.labstack.com/middleware/jwt/):
```
jwtConfig := middleware.JWTConfig{
SigningKey: publicKey,
SigningMethod: jwt.SigningMethodRS256.Name,
}
```
I believe that this middleware also should require only minimum for tokens parsing.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the middleware configuration and token-parsing path, focusing on how Authenticator, private key, public file, and encryption algorithm are validated. Done means a Gin application can omit Authenticator and private key while providing a public key and algorithm to read tokens and extract claims, without breaking existing token-issuing behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.