JWT middleware doesn't support RS256 tokens (auth0)
- Dominant language
- Go
- Stars
- 25.6k
- Forks
- 2.4k
- PR merge metrics
- No merged PRs in 30d
Description
I have client native application and RESTful backend uses **iris** for REST API
Client protected by user authentication by **Auth0.com**
Server protected by JWT, received by client during login.
**Auth0.com** for native application generates JTW token in RS256 format only
### **iris** validates this token and failes on the header validation step.
**iris** assumes that header contains only "**alg**" and "**typ**" parts
`{
"alg": "HS256",
"typ": "JWT"
}`
but RS256 token received from **auth0.com** contains "**kid**" part as well
`{
"alg": "RS256",
"typ": "JWT",
"kid": "*********"
}`
The problem itself happens in **katanas/jwt**, but although this package allows pass header validation function.
**iris/middleware/jwt** doesn't allow pass header validation function to fix this problem.
Contributor guide
Assessment
This issue has not been assessed yet.