search

go-chi / jwtauth

JWT authentication middleware for Go HTTP services
MIT License
550 stars 91 forks source link

Go 1.7 + Vendor jwt-go at v2.7 #9

Closed VojtechVitek closed 8 years ago

VojtechVitek commented 8 years ago

Breaks the API. We should release the Go 1.6 compatible version before merge.

advdv commented 7 years ago

I Would like to put this merge request up for discussion. Vendoring dependencies inside go libraries is discourages. Basically when I now vendor github.com/goware/jwtauth and next to that I vendor github.com/dgrijalva/jwt-go at version 2.7 myself the 'inner version' of jwtauth takes precedence and makes jwt tokens inside the request context unusable: 

interface conversion: interface {} is *jwt.Token(github.com/dgrijalva/jwt-go/vendor/github.com/goware/jwtauth), not *jwt.Token(github.com/goware/jwtauth)

A more in-depth discussion can be found here: https://github.com/Masterminds/glide/issues/303

In my opinion a warning at the top of the README is enough and this library should not include its own vendor directory.

pkieltyka commented 7 years ago

@advanderveer I agree with you, I don't think the Go dep tools are suited for vendor folders from deps of deps

VojtechVitek commented 7 years ago

@advanderveer We use govendor as dep tool and it resolves the inner dependencies just fine. This project is only compatible with 2.7, that's why we added the dependency explicitly.

Since glide can't recognize two exact same versions (well, it should) -- can you just remove vendor/ dir from this dependency by hand?