search

Keats / jsonwebtoken

JWT lib in rust
MIT License
1.64k stars 260 forks source link

Would it be possible to make DecodingKey more test friendly? #273

Open tkrause opened 1 year ago

tkrause commented 1 year ago

Currently DecodingKey::as_bytes is crate public which means you can't even get the secret out of the DecodingKey that you originally put in.

Additionally it does not implement Debug or PartialEq so once you create a DecodingKey you cannot compare for testing purposes ever. This is really a pain point if you're trying to test your decoding logic to support many algorithms and keys using JWK as well as static secrets.

DecodingKey should really implement the std::cmp::PartialEq interface at the very least.

A similar issue exists with Algorithm where you have to resort to matching in order to implement Debug on types using it. Ideally the library would handle this case as well converting Algorithm back to a string.

Keats commented 1 year ago

We can implement PartialEq but if we implement a Debug it should be a custom implementation that just prints the algorithm and not the data contained in it to avoid accidental dump of secrets in logs.

Keats commented 1 year ago

Let's not implement PartialEq actually, only a custom Debug: https://github.com/Keats/jsonwebtoken/issues/220