There is no "typ" header in version 2.0.0 #233
Comments
ptarud
changed the title
|
The See: #174 and https://tools.ietf.org/html/rfc7519#section-5. Does this change cause any issues for you? |
excpt
changed the title
|
Not, but I think that for other people could be generate a issue if they use other media types in addition to JWT token. I have included it by my self, but I think would be better to include "typ" header on JWT token by default. |
|
After upgrading to 2.0, my tests were failing. Took me a second to realize it was because of this change. The token fixture I had included the |
|
@lleger Thank you very much for offering help. 🥇 |
|
Hi, I just want to know if starting
or not? |
|
another way around, JWT was a default header before 2.0.0 |
The 'typ' header is no longer included by default with the ruby-jwt gem. See this issue: jwt/ruby-jwt#233
|
I would like to comment on this (unfortunately) closed issue. |
|
FYI, Auth0 started rejecting JWT tokens without the |
For BloodRelay I want to use a newer version of the Auth0 library. URI.escape has been throwing deprecation warnings for a while but now it's removed from Ruby 3 which means we need to be on a newer version of Auth0 that no longer uses that method[1]. Had to decide if we want to stay on the 4.x series of Auth0 or the 5.x series due to a breaking change in `create_user` (or have our library detect the version and call with the right arguments)[2]. I opted to require v5 since it is better tested against recent versions of Ruby[3]. Upgrading the auth0 gem required moving to the 2.2.x series of the JWT library. The method doing the base64 encoding of the JWT signature has moved. Also the `typ` header is no longer generated[4]. It seems it is not required by the spec but Auth0 does require it so adding it as a parameter manually. The algorithm param is the same as the default. I just had to specify it to pass in header options. Other than these library upgrades and the code changes caused by the upgrades this commit includes no change in functionality. The test suite passes but since it's heavily mocked I'll also note I have already tested this against an upgraded version of BR to verify it really doesn't break anything (this is how the `typ` thing was discovered). 1. auth0/ruby-auth0#202 2. auth0/ruby-auth0#244 3. auth0/ruby-auth0#256 4. jwt/ruby-jwt#233
Why there is no
typeheader in version 2.0.0 ?The text was updated successfully, but these errors were encountered: