Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow JWTs signed with RS256 asymmetric keys. #4

Open
wants to merge 23 commits into
base: master
Choose a base branch
from

Conversation

dmunch
Copy link

@dmunch dmunch commented Apr 22, 2016

This PR enables verification of JWTs signed with the RS256 algorithm. Since ejwt only implements HS256 the first step was to use the JWT library jose instead of ejwt. In the second step I added the verification with the RS256 public key. The public key is configured by a new enty int he .ini file called rs_public_key and must be given in PEM format. I added tests also for the edge case where hs_secret and rs_public_key are set at the same time.

Open questions:

  • I changed some of the tests in order to reflect the exceptions thrown by jose which aren't always the same as the exceptions of ejwt. I don't think it's a big problem since there's a big try/catch in jwt_authentication_handler, but I'd like to have a confirmation on that.
  • I'm not sure that including the public key in the .ini file is the best way, however at the time being it's the easiest way I've found. Is there a way for a CouchDB plugin to load another file in the file system? This way the public key could be placed in its own file.

This is my very first pull request for CouchDB in general and in Erlang in particular, so I'd be more than happy for reviews, suggestions and possible improvements.

Thanks in advance,
Daniel

@dmunch
Copy link
Author

dmunch commented Sep 13, 2016

We're using those modifications in production now and I think the implementation is pretty complete and tested. Once again it was my first project in Erlang used in production, so I would be happy about review and corrections. And even more happy if that pull request would be accepted!

@dmunch dmunch changed the title Allow JWTs signed with RS256 asymmetric keys. WIP. Allow JWTs signed with RS256 asymmetric keys. Sep 13, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant