sirwolfgang / jwt_keeper Goto Github PK

You can force invalidations of all tokens by changing the secret, which would is already necessary in the event of a security compromise. However given changes to the application, the addition or removal of data from the JWT may be necessary. [From hive-xyz/hive#20]

The goals of this are to allow you to rotate out these breaking changes without having to forcing users to reauthenticate, while not requiring the developer to implement feature or token version checking logic.

Could not find generator 'j_w_t_keeper:install'. Maybe you meant 'j_w_t_keeper:install'

ActiveSupport is used purely out of laziness. It looks like its only use is around things relating to DateTime.

Its designed to work with sorcery, people should know how.

https://www.chosenplaintext.ca/2015/03/31/jwt-algorithm-confusion.html

I am not really happy with the action controller interface; but I am not entirely sure what a better interface would look like.

There is a case to be made that you rotate the tokens every request to prevent replay attacks, but only wish to revalidate the cached contents every so often.