Comments (8)
If you're going to implement the various JSON standards, maybe you'd like to add it to itsdangerous and depend on that? There have been a number of requests for it, we only have JWS right now.
from authlib.
@davidism It can be quite complex, especially for PEM JWK supports. Currently, itsdangerous is a single file, it is quite simple. Is there any plan to support all those things?
Authlib depends on PyJWT currently. My plan is to create a monolithic library so that I can take everything into control. But if there is a plan for itsdangerous to do such thing, I'm happy to implement those JSON things in itsdangerous.
from authlib.
Yeah, I think @mitsuhiko expressed interest in supporting that. I actually wanted to restructure it as a package anyway, so moving the JSON stuff to a json
sub-package is fine.
from authlib.
Or, uh, maybe he said the exact opposite? pallets/itsdangerous#54
Currently there's just confusion because we implement JWS with a time extension which looks sort of like JWT. pallets/itsdangerous#73
I'm not really sure which way we should actually go. Sorry, I initially saw this and thought of itsdangerous, but now that I think about it I'm not sure if keeping itsdangerous simple is better.
from authlib.
@davidism having had to many security issues with JWT and friends I do not longer recommend people to use it. Hoping someone makes something better.
from authlib.
So...What is the recommendation for authorization?
from authlib.
Server integration with an async web engine such as aiohttp would be great.
from authlib.
Please consider implementing the User-Managed Access (UMA) 2.0 layer.
from authlib.
Related Issues (20)
- rfc7519 JsonWebEncryption is initialized with an incorrect list of algorhythms.
- Incorrect check for insecure transport on OAuth1.0
- Have special character encoding be optional
- Quoting (URL-encoding) Base authentication username / password is incorrect HOT 1
- JWT authentication issue HOT 3
- Allow to disable expired token auto-refresh
- Need to be able to add headers when calling authorize_redirect() HOT 2
- do not have refresh token HOT 2
- JWTClaims accepts True/False `iat`.
- Too slow to generate id token with RSA HOT 1
- Token refresh failed when using AsyncOAuth2Client with client credentials
- getting no client id from vk.com oauth HOT 1
- Change token in session HOT 2
- Algorithm confusion when verifying JSON Web Tokens with asymmetric public keys HOT 5
- Support for plain code_challenge_method HOT 4
- Why self.form.get('grant_type') and not self.data.get('grant_type') ? HOT 10
- New token will not be fetched if grant_type='client_credentials' is passed for fetch_token()
- Unpinned Dependency on cryptography Breaks Installation Due to Rust Requirement HOT 1
- Python 3.12 support
- EdDSA fails to decrypt JWTs
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from authlib.