search

tuupola / slim-jwt-auth

PSR-7 and PSR-15 JWT Authentication Middleware
https://appelsiini.net/projects/slim-jwt-auth
MIT License
827 stars 141 forks source link

Relaxed setting should also accept IP address #239

Closed tnafele closed 1 year ago

tnafele commented 1 year ago

'relaxed' => ['localhost', '10.10.10.15'],

Calling from 10.10.10.15 throws 500 error. I guess this config parameter only accepts names? In development LAN there's often no DNS...

tuupola commented 1 year ago

Paste curl request and results here:

$ curl --include --ipv4 http://10.10.10.15
...
tnafele commented 1 year ago

@tuupola Ahhh! I did misunderstand the option: I thought I have to add the IP/name of the clients for which SSL is not required (which would make more sense IMHO).

tnafele commented 1 year ago

To make my issue more clear: Maybe needs better description in the doc of how exactly the 'relaxes' property is treated. I added the IP of the client from which I wanted to connect with plain text connection...

tuupola commented 1 year ago

Improved the wording on the security section: https://github.com/tuupola/slim-jwt-auth/pull/241