IndominusByte / fastapi-jwt-auth

FastAPI extension that provides JWT Auth support (secure, easy to use, and lightweight)
http://indominusbyte.github.io/fastapi-jwt-auth/
MIT License
660 stars 153 forks source link

Custom claims are not always available #6

Closed rassie closed 4 years ago

rassie commented 4 years ago

It seems fastapi-jwt-auth (current git HEAD) adds custom claims identity and type to the tokens it generates and also expects any incoming tokens to contain those claims. This is not the case if tokens are generated by a third-party provider. Is most cases identity can be replaced via standard claim sub, while type is mostly available via typ (which might not be standard).

Could you share the reasoning behind these claims?

IndominusByte commented 4 years ago

first, I use identity claims because that package I use to make jwt its doesn't support to add sub claims which is refer to pyjwt, and the type claims its identify incoming token its access token or refresh token in some cases you only want to accept refresh token to your endpoint.

IndominusByte commented 4 years ago

after I did research about claims information, I decide to change identity claim to standard claim using 'sub', thanks for your information 🙏