Allow list of valid audiences (#205 continued) #306

r-springer · 2017-11-14T22:47:39Z

Extending @codervinod's work in #246 for #205 (since there's no progress there recently), addressing the PR feedback.

…nfigured Added test cases to check if audience is provided a list.

FraBle · 2017-11-14T22:54:36Z

👍

coveralls · 2017-11-14T22:55:45Z

Coverage remained the same at 100.0% when pulling dd3df0f on r-springer:master into c1253ec on jpadilla:master.

coveralls · 2017-11-14T22:55:45Z

Coverage remained the same at 100.0% when pulling dd3df0f on r-springer:master into c1253ec on jpadilla:master.

coveralls · 2017-11-14T23:02:26Z

Coverage remained the same at 100.0% when pulling db5951e on r-springer:master into c1253ec on jpadilla:master.

coveralls · 2017-11-15T00:22:10Z

Coverage remained the same at 100.0% when pulling 02b8162 on r-springer:master into c1253ec on jpadilla:master.

mark-adams

Conceptually, I think this is definitely an improvement but I'd like a couple changes.

mark-adams · 2017-11-21T19:32:02Z

jwt/api_jwt.py

@@ -103,8 +102,8 @@ def _validate_claims(self, payload, options, audience=None, issuer=None,
        if isinstance(leeway, timedelta):
            leeway = leeway.total_seconds()

-        if not isinstance(audience, (string_types, type(None))):
-            raise TypeError('audience must be a string or None')
+        if not isinstance(audience, (string_types, type(None), list)):


I think it might be better to use collections.Iterable to allow any iterable type to be used instead of just a list. Seems a little more idiomatic that way.

mark-adams · 2017-11-21T19:34:34Z

jwt/api_jwt.py

+        if isinstance(audience, string_types):
+            audience = [audience]
+
+        for aud in audience:


What about nixing 183 - 186 and doing:

if not any((aud in audience for aud in audience_claims)): raise InvalidAudience('Invalid audience')

mark-adams · 2017-11-21T19:35:37Z

jwt/api_jwt.py

-        if not isinstance(audience, (string_types, type(None))):
-            raise TypeError('audience must be a string or None')
+        if not isinstance(audience, (string_types, type(None), list)):
+            raise TypeError('audience must be a string, list of strings, or None')


Let's make this iterable instead of list of strings

mark-adams · 2017-11-21T19:37:24Z

CHANGELOG.md

@@ -11,6 +11,9 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 - Dropped support for python 2.6 and 3.3 [#297][297]

 ### Fixed
+
+- Audience parameter now supports lists in compliance with RFC 7519 [#306][306]


Let's drop in compliance with RFC 7519. This is purely an API design decision in the library. RFC 7519 does not require libraries to allow multiple audience values when validating a token. It does require libraries to allow the token to contain multiple values for the aud claim. This change does not make the library any more or less compliant with the RFC, it just makes the API a little more pleasant in the use case that you have multiple possible allowed audiences in your use case.

You're right. I actually misread that. Dropped the mentioned part and moved it to changed instead of fixed.

- nicer way of checking audience against claims

r-springer

Thanks for the review. Feedback incorporated 🙂

r-springer · 2017-11-24T21:45:00Z

CHANGELOG.md

@@ -11,6 +11,9 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 - Dropped support for python 2.6 and 3.3 [#297][297]

 ### Fixed
+
+- Audience parameter now supports lists in compliance with RFC 7519 [#306][306]


You're right. I actually misread that. Dropped the mentioned part and moved it to changed instead of fixed.

…returning

coveralls · 2017-11-24T21:56:42Z

Coverage remained the same at 100.0% when pulling 504f63c on r-springer:master into c1253ec on jpadilla:master.

coveralls · 2017-11-24T22:07:31Z

Coverage remained the same at 100.0% when pulling 6fa0f74 on r-springer:master into c1253ec on jpadilla:master.

mark-adams · 2017-11-25T03:41:26Z

jwt/api_jwt.py

            raise InvalidAudienceError('Invalid audience')

+        return


This return is extraneous since we're at the end of the function, right?

mark-adams · 2017-11-25T03:42:04Z

tests/test_api_jwt.py

@@ -92,7 +91,7 @@ def test_decode_with_invalid_audience_param_throws_exception(self, jwt):
            jwt.decode(example_jwt, secret, audience=1)

        exception = context.value
-        assert str(exception) == 'audience must be a string or None'
+        assert str(exception) == 'audience must be a string, Iterable, or None'


It's probably ok to just say iterable here instead of Iterable. I think most people have an understanding of what an iterable is with regards to Python.

mark-adams · 2017-11-25T03:42:53Z

I left a couple additional comments. Once those are taken care of, I think we'll be good to go.

coveralls · 2017-11-27T00:24:40Z

Coverage remained the same at 100.0% when pulling 0a0a423 on r-springer:master into c1253ec on jpadilla:master.

mark-adams · 2017-11-27T04:03:40Z

Thanks for the excellent contribution @codervinod! 🎉

Demonstrate to users reading the documentation that the `audience` parameter is not restricted to the `string` type, but can also accept an iterable, as implemented in PR#306 jpadilla#306

* Add code example for `aud` being an array The previous code example only showed the `aud` claim as a single case-sensitive string, despite the documentation mentioning that the `aud` claim can be an array of case-sensitive strings Add a code block demonstrating the `aud` claim being an array of case-sensitive strings to make it more clear to the user that it is a permitted use of the `aud` claim * Add example of the `audience` param as an iterable Demonstrate to users reading the documentation that the `audience` parameter is not restricted to the `string` type, but can also accept an iterable, as implemented in PR#306 #306 * Fix short title underlines Short title underlines throw warnings in reStructuredText linters

* Add code example for `aud` being an array The previous code example only showed the `aud` claim as a single case-sensitive string, despite the documentation mentioning that the `aud` claim can be an array of case-sensitive strings Add a code block demonstrating the `aud` claim being an array of case-sensitive strings to make it more clear to the user that it is a permitted use of the `aud` claim * Add example of the `audience` param as an iterable Demonstrate to users reading the documentation that the `audience` parameter is not restricted to the `string` type, but can also accept an iterable, as implemented in PR#306 jpadilla/pyjwt#306 * Fix short title underlines Short title underlines throw warnings in reStructuredText linters

Vinod Gupta and others added 6 commits March 15, 2017 12:08

Resolved issue jpadilla#205, Allow a list of valid audiences to be co…

d50e53b

…nfigured Added test cases to check if audience is provided a list.

Take care of review comments related to audience list.

0bc8ad9

Merge branch 'master' into master

fcf32b3

check type of audience parameter in old place

dd3df0f

Merge remote-tracking branch 'upstream/master'

34a33f3

update changelog

db5951e

fix linter errors

02b8162

jpadilla approved these changes Nov 17, 2017

View reviewed changes

jpadilla requested a review from mark-adams November 17, 2017 19:27

jquense mentioned this pull request Nov 20, 2017

Add support for checking against multiple issuers #308

Closed

mark-adams suggested changes Nov 21, 2017

View reviewed changes

r-springer added 2 commits November 24, 2017 13:40

fix changelog

c3d9437

- support Iterable for audience instead of just list to be more generic

504f63c

- nicer way of checking audience against claims

r-springer commented Nov 24, 2017

View reviewed changes

check for audience claims not being valid instead of being valid and …

6fa0f74

…returning

mark-adams reviewed Nov 25, 2017

View reviewed changes

spell iterable without capital I, remove unnecessary return

0a0a423

mark-adams approved these changes Nov 27, 2017

View reviewed changes

mark-adams merged commit 7f7d524 into jpadilla:master Nov 27, 2017

jpadilla mentioned this pull request Nov 29, 2017

Resolved issue #205, Allow a list of valid audiences to be configured #246

Closed

jpadilla added this to the v1.6.0 milestone Feb 27, 2018

This was referenced Mar 19, 2018

Bump pyjwt from 1.5.3 to 1.6.1 lipis/crypto-pocket#103

Closed

Bump pyjwt from 1.5.3 to 1.6.1 gae-init/gae-init-magic#43

Closed

Bump pyjwt from 1.5.3 to 1.6.1 gae-init/gae-init-docs#173

Closed

CorreyL mentioned this pull request Apr 24, 2020

Improve documentation for audience usage #484

Merged

vorpal-buildbot mentioned this pull request Jun 15, 2020

Scheduled weekly dependency update for week 24 PennyDreadfulMTG/Penny-Dreadful-Tools#7435

Merged

nnadams mentioned this pull request Mar 21, 2022

Update docs to show an audience list can be provided snok/django-auth-adfs#229

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow list of valid audiences (#205 continued) #306

Allow list of valid audiences (#205 continued) #306

r-springer commented Nov 14, 2017 •

edited

Loading

FraBle commented Nov 14, 2017

coveralls commented Nov 14, 2017 •

edited

Loading

coveralls commented Nov 14, 2017

coveralls commented Nov 14, 2017 •

edited

Loading

coveralls commented Nov 15, 2017 •

edited

Loading

mark-adams left a comment

mark-adams Nov 21, 2017

mark-adams Nov 21, 2017

mark-adams Nov 21, 2017

mark-adams Nov 21, 2017

r-springer Nov 24, 2017

r-springer left a comment

r-springer Nov 24, 2017

coveralls commented Nov 24, 2017 •

edited

Loading

coveralls commented Nov 24, 2017 •

edited

Loading

mark-adams Nov 25, 2017

mark-adams Nov 25, 2017

mark-adams commented Nov 25, 2017

coveralls commented Nov 27, 2017 •

edited

Loading

mark-adams commented Nov 27, 2017

Allow list of valid audiences (#205 continued) #306

Allow list of valid audiences (#205 continued) #306

Conversation

r-springer commented Nov 14, 2017 • edited Loading

FraBle commented Nov 14, 2017

coveralls commented Nov 14, 2017 • edited Loading

coveralls commented Nov 14, 2017

coveralls commented Nov 14, 2017 • edited Loading

coveralls commented Nov 15, 2017 • edited Loading

mark-adams left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

r-springer left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

coveralls commented Nov 24, 2017 • edited Loading

coveralls commented Nov 24, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mark-adams commented Nov 25, 2017

coveralls commented Nov 27, 2017 • edited Loading

mark-adams commented Nov 27, 2017

r-springer commented Nov 14, 2017 •

edited

Loading

coveralls commented Nov 14, 2017 •

edited

Loading

coveralls commented Nov 14, 2017 •

edited

Loading

coveralls commented Nov 15, 2017 •

edited

Loading

coveralls commented Nov 24, 2017 •

edited

Loading

coveralls commented Nov 24, 2017 •

edited

Loading

coveralls commented Nov 27, 2017 •

edited

Loading