Upgrading to dgrijalva/jwt-go/v4

[mariaefi29]

Issue Description

Dear developers,

First of all, thank you for creating and maintaining such a cool router! Very easy to use.

Second of all, could you please kindly update github.com/dgrijalva/jwt-go v3.2.0+incompatible to a version 4 that has modules and more reliable I guess.

Checklist

• Dependencies installed
• No typos
• Searched existing issues and docs

Expected behaviour

I use a handler func that gets claims out of JWT token and checks roles.

It is similar to what you have in you docs:

func isAdmin(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		user := c.Get("user").(*jwt.Token)
                 ...

I expected it to work :)

Actual behaviour

However, it failed if I use version 4 of jwt-go. The errors is
interface conversion: interface {} is *jwt.Token, not *jwt.Token (types from different packages)

Similar issue: dgrijalva/jwt-go#401

So in order to solve this issue I had to switch to v3.2.0 you are using.

Can we please fix it in version 5 due to compatibility break?

Version/commit

v4.1.15

[kopaygorodsky]

security checkers return Jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). because the type assertion fails, "" is the value of aud. this is a security problem if the jwt token is presented to a service that lacks its own audience check.

[aldas]

About that aud problems see #1663 (comment) or dgrijalva/jwt-go#422 (comment)

TLDR: if you are not checking aud in your code or have NOT made it OPTIONAL - you are safe.

Regarding jwt middleware. We are thinking of address it - no direct actions yet. Whether it is refactoring so that there are no direct dependency to explicit library or move jwt middleware to separate lib or some other thing that guards core more from problems with third party libs.

[aldas]

We introduced JWTConfig.ParseTokenFunc as way to use different JWT libraries or versions with current JWT middleware.

echo/middleware/jwt.go

Line 92 in 1ac4a8f

ParseTokenFunc func(auth string, c echo.Context) (interface{}, error)

Example can be seen here: #1887

This will be released soon in v4.4

[mariaefi29]

Dear @aldas,

Thank you for letting us know! We will definitely try this out or we will wait for v5

[aldas]

done in #1946