dorinclisu / fastapi-auth0

FastAPI authentication and authorization using auth0.com
MIT License
230 stars 39 forks source link

Function of `auth0_rule_namespace`? #2

Closed jtc42 closed 3 years ago

jtc42 commented 3 years ago

Hey, thanks for working on this! The timing is amazing for me.

I've been trying to get to grips with the code for this module, and I'm just wondering what's the function of the auth0_rule_namespace constant? The only time it's used seems to be in the Auth0 user model, as an alias for email. Mostly for my own sanity I was wondering if you could clarify what this is for?

Thanks!

Joel

dorinclisu commented 3 years ago

Hi, you need to use this constant in the rule for obtaining email address, otherwise user.email will always be None (and deny authorization if email_auto_error = True in Auth0() constructor).

The requirement for a namespace is enforced by auth0 in order to clearly differentiate between standard and non-standard claims in an access token. Without a namespace, auth0 will silently ignore the rule.

Screenshot 2021-03-01 at 18 03 17
jtc42 commented 3 years ago

Oh I see! I got confused by the documentation. That's on me misreading it though. Thanks!