kataras / kataras/iris

JWT middleware doesn't support RS256 tokens (auth0)

Open
#2,192 3 comments 0 reactions 1 assignee Claimed by @kataras View on GitHub
Dominant language
Go
Stars
25.6k
Forks
2.4k
PR merge metrics
No merged PRs in 30d

Description

I have client native application and RESTful backend uses **iris** for REST API
Client protected by user authentication by **Auth0.com**
Server protected by JWT, received by client during login.
**Auth0.com** for native application generates JTW token in RS256 format only

### **iris** validates this token and failes on the header validation step.

**iris** assumes that header contains only "**alg**" and "**typ**" parts

`{
"alg": "HS256",
"typ": "JWT"
}`

but RS256 token received from **auth0.com** contains "**kid**" part as well

`{
"alg": "RS256",
"typ": "JWT",
"kid": "*********"
}`

The problem itself happens in **katanas/jwt**, but although this package allows pass header validation function.
**iris/middleware/jwt** doesn't allow pass header validation function to fix this problem.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.