Comments (5)
For the sake of completeness, the code for the rfc6750 variant goes like this:
jwtOptions.jwtFromRequest = ExtractJwt.fromAuthHeaderWithScheme('Bearer');
use this with the example provided in https://github.com/themikenicholson/passport-jwt#configure-strategy.
Thanks @themikenicholson for putting this together! 🍾
from passport-jwt.
JWT is not strictly used with the OAuth framework. It can be used within the OAuth2.0 framework or as a standalone authentication mechanism.
While the default scheme of JWT
used in ExtractJwt.fromAuthHeader()
doesn't comply with RFC 6750, the library provides ExtractJwt.fromAuthHeaderWithScheme(auth_scheme)
. This leaves it up to the user to decide if they are using JWT within the context of an OAuth2.0 framework or their own custom auth scheme and implement accordingly.
I wish the default value better complied with OAuth2.0 but I did not originally implementing this library with OAuth in mind. Changing the default value would necessitate a major version # rev since it would break compatibility for anyone relying on the old default behavior.
I'll tag this as 3.0.0 for now but I don't intend to fix it until I have better reasons to cut a major release since the library provides a path RFC 6750-compliant implementation already.
from passport-jwt.
@JemiloII Authorization headers typically contain an authentication scheme along with the token or auth parameter. I think it was RFC 2617. I'm going to stick with the RFC compliant behavior.
If you don't like the standard behavior you can write your own extractor function.
from passport-jwt.
Can we have it not look for JWT in the header and have it retrieve just the token. I don't like the stub.
from passport-jwt.
"This leaves it up to the user to decide if they are using JWT within the context of an OAuth2.0 framework or their own custom auth scheme and implement accordingly."
Technically speaking, JWT is the "custom auth scheme", while Bearer is the standards compliant scheme required by the JWT specification itself as well as OAuth specs. Defaulting to a NON-standard scheme is a bad idea, as Ryan rightly pointed out in his first post.
from passport-jwt.
Related Issues (20)
- Multiple JWKS URIs HOT 4
- "TypeError: JwtStrategy requires a secret or key" with NestJS HOT 5
- Disallow None algorithm by default HOT 6
- Project Status HOT 8
- Passport-jwt extractor fromUrlQueryParameter don't handle handshake requests (websocket) HOT 1
- I'm always unauthorized. HOT 2
- How to ignore ignoreExpiration for a specific endpoint? HOT 1
- Add Custom extractor which takes JwtFromRequestFunction as argument HOT 1
- Provide own jwt-verify option HOT 1
- Is cookieExtractor buggy?
- How to create new jwt Token HOT 1
- vulnerability in passport-jwt's dependancy jsonwebtoken HOT 7
- JWT verification for auth code or PKCE flow HOT 1
- jsonwebtoken update to ^9.0.0 in [email protected] was a breaking change HOT 1
- [email protected] > [email protected] vulnerability HOT 1
- TypeError: JwtStrategy requires a secret or key getting this error while running in node.js
- Passport authentication with JWTStrategy not working even jwt is not getting called even the console.log({ jwt_payload }); is not getting called HOT 2
- use `request.header(AUTH_HEADER)` instead of `request.headers[AUTH_HEADER]`
- Confirm if development is still active HOT 1
- MongooseError: Model.findOne() no longer accepts a callback
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from passport-jwt.