Support "jti" (JWT ID) Claim
Open
Administration/Auth/SSO
Type:New Feature
- Dominant language
- Clojure
- Stars
- 49.3k
- Forks
- 6.8k
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 653
Description
The "jti" (JWT ID) claim provides a unique identifier for the JWT.
The "jti" claim can be used to prevent the JWT from being replayed.
https://tools.ietf.org/html/rfc7519#section-4.1.7
Related to https://github.com/metabase/metabase/issues/28647 and https://github.com/metabase/metabase/issues/28646
Reference:
Ticket 2430
Contributor guide
Research direction
Start with RFC 7519 section 4.1.7 and review related issues 28646 and 28647 to clarify the intended behavior. Then locate the JWT authentication entry point and existing claim handling. The issue is complete when the agreed support for the jti claim is implemented and covered by the project's relevant tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- clojure
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100