search

Styria-Digital / django-rest-framework-jwt

JSON Web Token Authentication support for Django REST Framework
https://styria-digital.github.io/django-rest-framework-jwt/
MIT License
191 stars 57 forks source link

Allow a setting to omit the user_id from the token payload #20

Closed ashokdelphia closed 4 years ago

ashokdelphia commented 4 years ago

The default value preserves the current behaviour. Perhaps in a future version, you may want to make the default to not include it, but that would naturally be a breaking change.

As far as I can tell, the default behaviour doesn't use this value to look up the user, so omitting it should generally be safe (unless an application is relying on it when using the token).

In my particular case, this primary key is a serial number, which I would prefer not to leak to the outside world.

codecov-io commented 4 years ago

Codecov Report

Merging #20 into master will not change coverage. The diff coverage is 100%.

Impacted file tree graph

@@          Coverage Diff          @@
##           master    #20   +/-   ##
=====================================
  Coverage     100%   100%           
=====================================
  Files           6      6           
  Lines         247    249    +2     
  Branches       25     26    +1     
=====================================
+ Hits          247    249    +2
Flag Coverage Δ
#codecov 100% <100%> (ø) :arrow_up:
#dj111 100% <100%> (ø) :arrow_up:
#dj20 100% <100%> (ø) :arrow_up:
#dj21 100% <100%> (ø) :arrow_up:
#dj22 100% <100%> (ø) :arrow_up:
#drf310 100% <100%> (ø) :arrow_up:
#drf37 100% <100%> (ø) :arrow_up:
#drf38 100% <100%> (ø) :arrow_up:
#drf39 100% <100%> (ø) :arrow_up:
#py27 100% <100%> (ø) :arrow_up:
#py34 100% <100%> (ø) :arrow_up:
#py35 100% <100%> (ø) :arrow_up:
#py36 100% <100%> (ø) :arrow_up:
#py37 100% <100%> (ø) :arrow_up:
Impacted Files Coverage Δ
src/rest_framework_jwt/settings.py 100% <ø> (ø) :arrow_up:
src/rest_framework_jwt/utils.py 100% <100%> (ø) :arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update c130e5a...5a17fa1. Read the comment docs.

fitodic commented 4 years ago

@ashokdelphia Thanks for your contribution! I completely agree with you on not including sensitive information in JWTs (and cookies if enabled).

ashokdelphia commented 4 years ago

@fitodic Thanks for the quick turnaround and release!