Comments (6)
-
I don't see any reason to support asymmetric client authentication in IE.
-
It's not just "recommended" - my understanding is that IndeedDb is the only technically valid way to persist non extractable keys. But we could handle this case in the ways you suggest (allowing args to ready, or storing this particular property in IndexedDb).
-
Good call. It's okay to require a CryptoKey and an additional
alg
parameter if we need that to disambiguate. -
As in (3) -- could even combine these into a
publicJwk
argument, which would have the full public key, alg, and kid...
from client-js.
So, we could start with something like this:
interface ReadyOptions {
privateKey?: JWK | {
key: CryptoKey
alg: "RS384" | "ES384"
kid: string
};
clientPublicKeySetUrl?: string; // for jku
[key: string]: any; // Other options TBD
}
FHIR.oauth2.ready({
privateKey: {
key: CryptoKeyObject,
alg: "RS384",
kid: "1234"
},
clientPublicKeySetUrl: "https://whatever"
}).then(client => ... )
Then, depending on if and how people use that, we may also consider IndexedDb
.
My only question so far is why did you name this "publicJwk argument" above, instead of private - by mistake, or am I missing something?
from client-js.
So, we could start with something like this
Yes, that would be a safe way to start
My only question so far is why did you name this "publicJwk argument" above, instead of private - by mistake, or am I missing something?
Oh, I was suggesting something like
FHIR.oauth2.ready({
privateKey: CryptoKeyObject,
publicJwk: {
"kty": "EC",
"kid": "3Kfdg-XwP-7gXyywtUfUADwBumDOPKMQx-iELL11W9s",
"use": "sig",
"alg": "ES256",
"crv": "P-256",
"x": "11XvRWy1I2S0EyJlyf_bWfw_TQ5CJJNLw78bHXNxcgw",
"y": "eZXwxvO1hvCY0KucrPfKo7yAyMT6Ajc3N7OkAB6VYy8",
},
clientPublicKeySetUrl: "https://whatever"
Just because the algorithm and the KID are already defined in that data model, but I am not pushing strongly for this suggestion.
from client-js.
Looks like we are talking about the same thing. In my example, if privateKey
has a key
property, then it should have the shape { key: CryptoKey, alg: "RS384" | "ES384", kid: string }
. Otherwise, privateKey
is expected to be valid JWK
having alg
, kid
and everything else.
What confuses me is that you have both privateKey
and publicJwk
. What is the idea behind using these together and why is that jwk public?
from client-js.
Your suggestion works well! (I hadn't fully understood it when I suggested separately supplying the alg/kid in the context of a public key input.)
from client-js.
This is now released in v2.5.0
from client-js.
Related Issues (20)
- Unable to authorize using PKCE HOT 2
- Typo in README
- Unable to get patientId after successful login HOT 1
- (Error handling skipped on init) CompleteAuth not triggered for init HOT 1
- includeResponse not working for FHIR update operations
- "target: popup" (etc) demos don't work in current Chromium HOT 2
- Single SMART_KEY breaks authorization of several users on server-side
- Jest + RTL :: Testing with FHIRClient
- Uncaught (in promise) Error: Failed to fetch the conformance statement from "https://staging-fhir.ecwcloud.com/fhir/r4/FFBJCD/metadata". TypeError: Network request failed HOT 6
- Question: Smart-On-Fhir implementation inside Service Worker
- FHIR type Meta requiring lastUpdated property when spec allows it to be optional
- Node js After 10 min 401 unauthorized response HOT 4
- Window closes itself when it's not actually a popup
- Save token info in DB
- Support of PKCE even when the EHR .well-known configuration is not set? HOT 2
- Assumption on patient id in context
- Improve or rename "Contributing and Development" section in README
- Zombie `changelog.md` file in the project's root.
- npm audit report semver vulnerability
- Cannot specify custom aud parameter and FHIR server URL
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from client-js.