search

frasertweedale / hs-jose

Haskell JOSE and JWT library
http://hackage.haskell.org/package/jose
Apache License 2.0
122 stars 46 forks source link

validate iat and an option to turn it off. #31

Closed haishengwu-okta closed 7 years ago

frasertweedale commented 7 years ago

On Fri, Dec 16, 2016 at 01:30:04AM -0800, Haisheng Wu wrote:

haishengwu-okta commented on this pull request.

@@ -74,7 +76,7 @@ spec = do

 describe "with an Expiration Time claim" $ do
   describe "when the current time is prior to the Expiration Time" $ do
  • let now = utcTime "2010-01-01 00:00:00"
  • let now = utcTime "2011-03-01 00:00:00"

it needs otherwise iat validation will failed or we could turn off iat validation for those cases. slightly prefer to update the value.

I'd prefer to just turn off "iat" claim validation while evaluating tests for other claims.

-- You are receiving this because you commented. Reply to this email directly or view it on GitHub: https://github.com/frasertweedale/hs-jose/pull/31

frasertweedale commented 7 years ago

Rebase is needed.

haishengwu-okta commented 7 years ago

@frasertweedale done the rebase

frasertweedale commented 7 years ago

@haishengwu-okta thanks, I have merged this to the master branch.

I can cut v0.5.0.2 on a maintenance branch soon. I have included your make JWTCrypto public change and your "iss" claim validation change. However, to include this change, I will have to - for the v0.5 branch only, disable "iat" claim checking by default, because if it is on by default, it could cause validation to fail where v0.5.0.1 succeeded.

So my question is: do you want this in a release Real Soon Now, but you will have to change the JWTValidationSettings to turn it on, or are you happy to use code from master or wait for v0.6 (there is no timeframe)?

haishengwu-okta commented 7 years ago

@frasertweedale thanks for quick feedback. v0.5.0.2 cut looks perfect to me for now.!

frasertweedale commented 7 years ago

@haishengwu-okta OK, so you don't want this change in v0.5.0.2, or you do want it (but defaulted to off)?

haishengwu-okta commented 7 years ago

@frasertweedale I want the iat claim checking in v0.5.0.2 but default to off so I could enable it via JWTValidationSettings

frasertweedale commented 7 years ago

Here you go: https://hackage.haskell.org/package/jose-0.5.0.2.

Thanks for your contributions!

haishengwu-okta commented 7 years ago

@frasertweedale great. thank you!