ueberauth / guardian

Elixir Authentication
MIT License
3.44k stars 381 forks source link

Option for encoding permissions as text instead of bitstrings #470

Closed jayashe closed 5 years ago

jayashe commented 6 years ago

For clients that aren't elixir applications that use Guardian, decoding permissions as bitstrings adds unnecessary hassle. Cowboy's header length limit is 4k bytes (as is NGINX), which is plenty of room to encode permissions as a string array of the granted permissions.

I propose a config setting permission_encoding with values :bitstring and :text (default :bitstring) to determine which strategy to use.

hassox commented 6 years ago

Hey @jgashe Thanks for the thought. If love to see an option to encode as string front is one, but I don't think it should be an option on the bitwise module. I was thinking if we want a different kind we should make a different module (hence the btwise in it's name). On the other hand we could pull out the encoding/decoding part into a behaviour interface and have a bitstring, text, JSON encoders.

Thoughts

mikemorris commented 6 years ago

On the other hand we could pull out the encoding/decoding part into a behaviour interface and have a bitstring, text, JSON encoders.

This sounds like a great proposal, I'd love to see an interface similar to https://www.npmjs.com/package/express-jwt-permissions supported (space-delimited string and/or array of strings).

Hanspagh commented 5 years ago

This is gonna be part of V2