Avoid setting exp claim from JWTManager #249
Conversation
|
The lexik-jose-bridge bundle marks the It does not include it as it seems that it is already set in the payload by the JWTManager service. |
|
Is the change itself fine to you? |
|
Yes it is. The payload sent by the JWTManager should contain only the claims related to the user authentication. |
chalasr
force-pushed
the
feature/avoid_setting_standard_claims_from_manager
branch
from
cc329c2
to
0d503a6
Compare
Update CHANGELOG/UPGRADE
chalasr
force-pushed
the
feature/avoid_setting_standard_claims_from_manager
branch
from
0d503a6
to
d50d1cc
Compare
chalasr
deleted the
feature/avoid_setting_standard_claims_from_manager
branch
| @@ -42,6 +42,12 @@ public function getConfigTreeBuilder() | |||
| ->end() | |||
| ->scalarNode('token_ttl') | |||
| ->defaultValue(3600) | |||
| ->validate() | |||
| ->ifTrue(function ($ttl) { | |||
| return !is_numeric($ttl); | |||
There was a problem hiding this comment.
we should allow null values here as per #117
There was a problem hiding this comment.
also why not simply make it an integerNode as I suspect that floats do not really make sense here ..
There was a problem hiding this comment.
this check has been moved at runtime in order to allow use of %env()% parameters in #325. The point of using is_numeric() is to support env vars too.
About allowing null, this has been changed accidentally and rediscussed in #250, having tokens with an infinite lifetime is not something we want to support regarding security
| @@ -15,7 +17,7 @@ For a diff between two versions https://github.com/lexik/LexikJWTAuthenticationB | |||
|
|
|||
| * feature [\#218](https://github.com/lexik/LexikJWTAuthenticationBundle/pull/218) Add more flexibility in token extractors configuration ([chalasr](https://github.com/chalasr)) | |||
|
|
|||
| * feature [\#217](https://github.com/lexik/LexikJWTAuthenticationBundle/pull/217) Refactor TokenExtractors loading for easy overriding ([chalasr](https://github.com/chalasr)) | |||
| * feature [\#217](https://github.com/lexik/LexikJWTAuthenticationBundle/pull/217) Refactor TokenExtractors loadi ng for easy overriding ([chalasr](https://github.com/chalasr)) | |||
The encoder should be responsible of setting the
expclaim and all other standard ones. @Spomky this might have an impact on thelexik_jose_bridge, excepted if you set this claim from the encoder anyway.ttlin*JWSProviderrather thanJWTManager