-
-
Notifications
You must be signed in to change notification settings - Fork 2.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
JWT, KeyAuth, CSRF multivalue extractors #2060
Conversation
…`next(c)` when error handler decides to swallow the error (returns nil).
Codecov Report
@@ Coverage Diff @@
## master #2060 +/- ##
==========================================
+ Coverage 91.57% 92.02% +0.44%
==========================================
Files 33 34 +1
Lines 2921 2972 +51
==========================================
+ Hits 2675 2735 +60
+ Misses 157 149 -8
+ Partials 89 88 -1
Continue to review full report at Codecov.
|
@lammel if you have time could you review. I like to include it in next release. |
Will look into it today. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good.
When comments from the review are resolved we should merge.
…ocs, add additional tests
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Guess that looks pretty good now. Cool stuff @aldas
Authentication
header with valueBearer xxxx
but your intracture has upstream proxy that adds Basic authentication also. Now even if you fill basic auth in browser and your application sends requests with JWT token you would be in trouble as previously JWT middleware knows only to extract firstAuthentication
header value - which could be JWT token but could be also Basic Auth. This change allows extractor to return all those header values and run JWT token checks or validation for Keyauth on them.NoErrorContinuesExecution
to JWT and KeyAuth middleware to allow continuing executionnext(c)
when error handler decides to swallow the error (returns nil). Usecase: This is useful in cases when portion of your site/api is publicly accessible and has extra features for authorized users. In that case you can use ErrorHandlerWithContext to set default public JWT token value to request and continue with handler chain. Note: this is similar to Allow JWT middleware to gracefully fail #2048p.s. there are ugly error handling parts just to preserve similar/same errors that those middlewares previously returned. Unfortunately all these 3 are quite inconsistent how they do error handling - JWT has 2 generic types. Keyauth has specific error values.