o1egl / paseto

Platform-Agnostic Security Tokens implementation in GO (Golang)
MIT License
833 stars 34 forks source link

Non-JSON messages #29

Closed vk-rv closed 3 years ago

vk-rv commented 3 years ago

Dear Oleg,

Thanks for your work.

Could I trouble you to explain claims encoding:

According to RFC PASETO encodes claims to be transmitted in a JSON.

I mentioned strings and byte slices are accepted "as is" in your library.

The only place where I can find a rationale for that is https://github.com/paragonie/paseto/tree/master/docs/02-PHP-Library#using-the-protocol-directly

But also I found: https://github.com/paragonie/paseto/issues/54#issuecomment-372414244

Is a JSON encoded payload part of the spec? Is it required that (received||sent) payloads are in this format, or optional?

Originally it was going to be optional so people could use Protobuf, etc. However, I've since decided to just use JSON.

I am somewhat confused in the background of the question / implementation.

It looks like PHP version has builder for assembling JSON and special pure routines for advanced optional usage and that is probably mixed in Go case?

Would you be so kind to help me?

Thank you in advance!