fastify / fastify/fastify-jwt

Add 'validate' option to allow token claim validation

Open
#316 3 comments 1 reaction 0 assignees View on GitHub
good first issue
Dominant language
JavaScript
Stars
586
Forks
120
PR merge metrics
No merged PRs in 30d

Description

### Prerequisites

- [X] I have written a descriptive issue title
- [X] I have searched existing issues to ensure the feature has not already been requested

### 🚀 Feature Proposal

Can we add a new `validate` option into the package? It should accept a function similar to the `trusted` option but allow us to do some custom json-schema based validations on the token payload. While the current 'trusted' option serves a similar purpose, repurposing might not be suitable given the name "trusted" which implies security and not validation.

While external validation (in the callback of `request.jwtVerify`) is an option, integrating 'validate' directly into @fastify/jwt aligns with JWT operations, offering more convenience and coherence. If the maintainers are on board with this proposal, I'd be more than willing to contribute by creating a Pull Request to implement the 'validate' option.

### Motivation

This feature is particularly valuable in scenarios involving external Identity Providers (IDPs) where unexpected modifications to claims can disrupt the application's functionality.

Thanks

### Example

```js
fastify.register(jwt, {
secret: 'supersecret',
validate: (request, tokenClaims) => {
// JSON schema-based validation logic
if (/* condition to check token validity */) {
return true; // Token claims are valid
} else {
throw new Error('Invalid token claims'); // Throw an error for invalid claims
}
}
});
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.