search

ExpressGateway / express-gateway

A microservices API Gateway built on top of Express.js
https://www.express-gateway.io
Apache License 2.0
2.97k stars 344 forks source link

Added algorithm option to jwt policy #999

Closed Brady-Conn closed 4 years ago

Brady-Conn commented 4 years ago

Hello, Express-gateway is fantastic — it has become the backbone of our team’s api architecture. That being said, we have run into one small issue. Problem: The JWT policy does not currently accept algorithms as an option to specify which algorithms can be used to verify tokens. Under the hood I noticed express-gateway uses passport-jwt, which uses jsonwebtoken. This is the same package we use. Both passport-jwt and jsonwebtoken support specifying algorithms. This is a good feature because otherwise jsonwebtoken will allow any algorithm to be used depending on what is decoded via the JWT header. Specifying algorithms allows enforcing of standards across our apis. Solution: Expose the algorithms option in the JWT policy. Here is the pr for the docs update: https://github.com/ExpressGateway/express-gateway.io/pull/336

codecov[bot] commented 4 years ago

Codecov Report

:exclamation: No coverage uploaded for pull request base (master@c294fa7). Click here to learn what that means. The diff coverage is n/a.

Brady-Conn commented 4 years ago

The tests failing in these pipelines, failed once(with the same timeout error) locally for me, but have since passed. Is there a way to re-try these pipelines?

XVincentX commented 4 years ago

I can take care of this and make sure all tests pass. Can you rebase with latest master?

Brady-Conn commented 4 years ago

Awesome, thank you. I just pushed up that rebase, let me know if there is anything else I can do.