feathersjs / feathers

The API and real-time application framework
https://feathersjs.com
MIT License
14.97k stars 742 forks source link

AuthenticationService getPayload method should use payload of AuthenticationResult #3419

Open claustres opened 5 months ago

claustres commented 5 months ago

We have created our own authentication strategy in order to automatically renew JWT, details can be see here. However, it appears that if the original token does contain some additional payload, the additional fields are lost in the newly generated token.

It seems to be caused by getPayload() because even if the input authentication result contains the payload it is not taken into account when generating the new token.

May we suggest to do something like this:

async getPayload(_authResult: AuthenticationResult, params: AuthenticationParams) {
    // Uses `params.payload`, `_authResult.authentication.payload`  or returns an empty payload
    if (_authResult.authentication && _authResult.authentication.payload) return _authResult.authentication.payload
    const { payload = {} } = params

    return payload
  }
claustres commented 5 months ago

I've tested the approach by extending the AuthenticationService class, it appears to work but I needed to remove from the result payload ['aud', 'iss'] otherwise it conflicts with default token options in config I guess. Here is the error message: create: Bad "options.expiresIn" option the payload already has an "exp" property.