Features Checklist about authlib

[davidism]

If you're going to implement the various JSON standards, maybe you'd like to add it to itsdangerous and depend on that? There have been a number of requests for it, we only have JWS right now.

[lepture]

@davidism It can be quite complex, especially for PEM JWK supports. Currently, itsdangerous is a single file, it is quite simple. Is there any plan to support all those things?

Authlib depends on PyJWT currently. My plan is to create a monolithic library so that I can take everything into control. But if there is a plan for itsdangerous to do such thing, I'm happy to implement those JSON things in itsdangerous.

[davidism]

Yeah, I think @mitsuhiko expressed interest in supporting that. I actually wanted to restructure it as a package anyway, so moving the JSON stuff to a json sub-package is fine.

[davidism]

Or, uh, maybe he said the exact opposite? pallets/itsdangerous#54

Currently there's just confusion because we implement JWS with a time extension which looks sort of like JWT. pallets/itsdangerous#73

I'm not really sure which way we should actually go. Sorry, I initially saw this and thought of itsdangerous, but now that I think about it I'm not sure if keeping itsdangerous simple is better.

[mitsuhiko]

@davidism having had to many security issues with JWT and friends I do not longer recommend people to use it. Hoping someone makes something better.

[jacoboar]

So...What is the recommendation for authorization?

[tyteen4a03]

Server integration with an async web engine such as aiohttp would be great.

[BnGx]

Please consider implementing the User-Managed Access (UMA) 2.0 layer.