search

ueberauth / guardian

Elixir Authentication
MIT License
3.43k stars 382 forks source link

Allow setting secret when verifying headers #183

Closed sntran closed 8 years ago

sntran commented 8 years ago

I have a JWT come from a third-party service (Auth0 in my case), that needs to be verified with a secret key. When this JWT is set in Authorization header, Guardian.Plug.VerifyHeader fails to verify the token.

I took a look at https://github.com/ueberauth/guardian/blob/master/lib/guardian/plug/verify_header.ex#L65 and saw that it used an empty params map. From what I understand, it won't verify with any secret key.

Is there a way to pass the secret into the plug so it can use it to verify?

sntran commented 8 years ago

I think I figure it out. Guardian does use the secret key in config to verify. Closing this.