Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

v5 Pre-Release #234

Merged
merged 12 commits into from
Feb 21, 2023
Merged

v5 Pre-Release #234

merged 12 commits into from
Feb 21, 2023

Commits on Dec 9, 2022

  1. Starting v5 development

    This commit serves as the basis for further `v5` developments. It will introduce some API-breaking changes, especially to the way tokens are validated. This will allow us to provide some long-wanted features with regards to the validation API. We are aiming to do this as smoothly as possible, however, with any major version. please expect that you might need to adapt your code.
    
    The actual development will be done in the course of the next week, if time permits. It will be done in seperate PRs that will use this PR as a base. Afterwards, we will probably merge this and release an initial 5.0.0-alpha1 or similar.
    oxisto committed Dec 9, 2022
    Configuration menu
    Copy the full SHA
    a90858a View commit details
    Browse the repository at this point in the history
  2. Remove StandardClaims in favor of RegisteredClaims (#235)

    This PR removes the old legacy standard claims, which have been deprecated since the beginning of the `v4` module in favor of the newer `RegisteredClaims`. Removing them before any further changes to the validation API is quite useful, as less code needs to be adapated.
    oxisto committed Dec 9, 2022
    Configuration menu
    Copy the full SHA
    6e66008 View commit details
    Browse the repository at this point in the history
  3. New validation API (#236)

    * New Validation API
    
    Some guidelines in designing the new validation API
    
    * Previously, the `Valid` method was placed on the claim, which was always not entirely semantically correct, since the validity is concerning the token, not the claims. Although the validity of the token is based on the processing of the claims (such as `exp`). Therefore, the function `Valid` was removed from the `Claims` interface and the single canonical way to retrieve the validity of the token is to retrieve the `Valid` property of the `Token` struct.
    * The previous fact was enhanced by the fact that most claims implementations had additional exported `VerifyXXX` functions, which are now removed
    * All validation errors should be comparable with `errors.Is` to determine, why a particular validation has failed
    * Developers want to adjust validation options. Popular options include:
      * Leeway when processing exp, nbf, iat
      * Not verifying `iat`, since this is actually just an informational claim. When purely looking at the standard, this should probably the default
      * Verifying `aud` by default, which actually the standard sort of demands. We need to see how strong we want to enforce this
    * Developers want to create their own claim types, mostly by embedding one of the existing types such as `RegisteredClaims`.
      * Sometimes there is the need to further tweak the validation of a token by checking the value of a custom claim. Previously, this was possibly by overriding `Valid`. However, this was error-prone, e.g., if the original `Valid` was not called. Therefore, we should provide an easy way for *additional* checks, without by-passing the necessary validations
    
    This leads to the following two major changes:
    
    * The `Claims` interface now represents a set of functions that return the mandatory claims represented in a token, rather than just a `Valid` function. This is also more semantically correct.
    * All validation tasks are offloaded to a new (optional) `validator`, which can also be configured with appropriate options. If no custom validator was supplied, a default one is used.
    
    Co-authored-by: Micah Parks <66095735+MicahParks@users.noreply.github.com>
    oxisto and MicahParks committed Dec 9, 2022
    Configuration menu
    Copy the full SHA
    1ef0fe8 View commit details
    Browse the repository at this point in the history

Commits on Feb 9, 2023

  1. Cleanup and documentation of verification functions (#262)

    This PR adds further documentation to the validator and does an additional cleanup to make the VerifyXXX functions more managable.
    oxisto committed Feb 9, 2023
    Configuration menu
    Copy the full SHA
    3a9ee81 View commit details
    Browse the repository at this point in the history

Commits on Feb 19, 2023

  1. Configuration menu
    Copy the full SHA
    66e2e01 View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    1e16f55 View commit details
    Browse the repository at this point in the history
  3. Update claims.go

    Co-authored-by: Michael Fridman <mf192@icloud.com>
    oxisto and mfridman committed Feb 19, 2023
    Configuration menu
    Copy the full SHA
    8144967 View commit details
    Browse the repository at this point in the history

Commits on Feb 20, 2023

  1. Adding more coverage (#268)

    oxisto committed Feb 20, 2023
    Configuration menu
    Copy the full SHA
    fa7a12b View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    57662e5 View commit details
    Browse the repository at this point in the history
  3. More documentation cleanup

    oxisto committed Feb 20, 2023
    Configuration menu
    Copy the full SHA
    4e6e1ba View commit details
    Browse the repository at this point in the history

Commits on Feb 21, 2023

  1. Configuration menu
    Copy the full SHA
    28dc523 View commit details
    Browse the repository at this point in the history
  2. Added initial migration guide

    oxisto committed Feb 21, 2023
    Configuration menu
    Copy the full SHA
    5dc3299 View commit details
    Browse the repository at this point in the history