-
Notifications
You must be signed in to change notification settings - Fork 61
Closed
Description
Currently we just pass the raw jwt secret in the headers
commit-boost-client/crates/signer/src/service.rs
Lines 98 to 114 in 07d03fd
| async fn jwt_auth( | |
| State(state): State<SigningState>, | |
| TypedHeader(auth): TypedHeader<Authorization<Bearer>>, | |
| mut req: Request, | |
| next: Next, | |
| ) -> Result<Response, SignerModuleError> { | |
| let jwt: Jwt = auth.token().to_string().into(); | |
| let module_id = state.jwts.get_by_right(&jwt).ok_or_else(|| { | |
| error!("Unauthorized request. Was the module started correctly?"); | |
| SignerModuleError::Unauthorized | |
| })?; | |
| req.extensions_mut().insert(module_id.clone()); | |
| Ok(next.run(req).await) | |
| } |
but we should instead generate / verify actual jwts eg via https://crates.io/crates/jsonwebtoken
ref: https://self-issued.info/docs/draft-jones-json-web-token-01.html
Metadata
Metadata
Assignees
Labels
No labels