-
Notifications
You must be signed in to change notification settings - Fork 4.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix/jwt errorhandling #1362
Fix/jwt errorhandling #1362
Conversation
-- Decode token to find out who the consumer is | ||
local jwt, err = jwt_decoder:new(token) | ||
if err then | ||
-- TODO: is this an internal server error? the token is invalid/cannot be parsed so isn't this a user error to be reported? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@thibaultcha ^^
The possible errors originate here
They seem user errors to me, any specific reason they are set to fail with a 500?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah those are user errors indeed.
@thibaultcha both remarks updated |
|
||
if self.params.algorithm == "HS256" and self.params.secret == nil then | ||
return helpers.responses.send_HTTP_BAD_REQUEST("No mandatory 'secret'") | ||
end |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The API is not the right place to perform schema validation. Schema validation must be performed at the Model layer, aka in the schema.lua
file.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thx, I see what you mean!
…ix/jwt_errorhandling # Conflicts: # spec/03-plugins/jwt/02-api_spec.lua
replaces #1247, see also #1244.