search

mpdavis / python-jose

A JOSE implementation in Python
MIT License
1.54k stars 236 forks source link

Implement RFC-7797 / JWS (Detached Payload) #166

Open loganvolkers opened 4 years ago

loganvolkers commented 4 years ago

JSON Web Signature (JWS) represents the payload of a JWS as base64url-encoded value and uses this value in the JWS Signature computation.

While this enables arbitrary payloads to be integrity protected, some have described use cases in which the base64url encoding is unnecessary and/or an impediment to adoption, especially when the payload is large and/or detached. This specification defines a means of accommodating these use cases by defining an option to change the JWS Signing Input computation to not base64url-encode the payload. This option is intended to broaden the set of use cases for which the use of JWS is a good fit.

Please consider implementing Detached Payload support.

blag commented 4 years ago

I would happily review and merge a pull request implementing this.

AFlowOfCode commented 2 years ago

For reference: https://datatracker.ietf.org/doc/html/rfc7797

@blag if you would still happily review and merge a pull request, it looks like @finvu has one linked to this issue, which @chayan-datta approved in March.

In any case support for this enhancement plus the elimination of the incorrectly hardcoded {"typ": "JWT"} header for JWSs (#204) would be excellent to see in this library. The proposed merge requests for this & #204 hardly seem complicated so why they are not being merged as the years go by is a bit baffling.