Skip to content

feat: Jwt-auth plugin no longer requires a private_key to be uploaded.#11597

Merged
nic-6443 merged 31 commits into
apache:masterfrom
dspo:dspo/remove-jwt-sign
Sep 27, 2024
Merged

feat: Jwt-auth plugin no longer requires a private_key to be uploaded.#11597
nic-6443 merged 31 commits into
apache:masterfrom
dspo:dspo/remove-jwt-sign

Conversation

@dspo

@dspo dspo commented Sep 23, 2024

Copy link
Copy Markdown
Contributor

Description

For security reasons, the API gateway should not accept uploads of users' private keys for issuing jwt tokens, and should no longer provide an API for issuing jwt tokens.
This PR removes the /apisix/plugin/jwt/sign API.

Checklist

  • I have explained the need for this PR and the problem it solves
  • I have explained the changes or the new features added to this PR
  • I have added tests corresponding to this change
  • I have updated the documentation to reflect this change
  • I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

@dspo dspo changed the title (WIP) feat: remove /jwt/sign chore: remove /jwt/sign Sep 23, 2024
@dspo dspo changed the title chore: remove /jwt/sign refactor: remove /jwt/sign Sep 24, 2024
@dspo dspo changed the title refactor: remove /jwt/sign refactor: remove API /apisix/plugin/jwt/sign Sep 24, 2024
@dspo
dspo marked this pull request as ready for review September 24, 2024 04:12
@dosubot dosubot Bot added size:XXL This PR changes 1000+ lines, ignoring generated files. doc Documentation things plugin labels Sep 24, 2024
@dspo
dspo marked this pull request as draft September 24, 2024 06:00
Comment thread apisix/plugins/jwt-auth.lua Outdated
Comment thread apisix/plugins/jwt-auth.lua Outdated
@dspo dspo changed the title refactor: remove API /apisix/plugin/jwt/sign feat: remove API /apisix/plugin/jwt/sign Sep 25, 2024
@dspo
dspo marked this pull request as ready for review September 25, 2024 01:13
@dosubot dosubot Bot added the enhancement New feature or request label Sep 25, 2024
@dspo dspo changed the title feat: remove API /apisix/plugin/jwt/sign feat: Jwt-auth plugin no longer requires a private_key to be uploaded. Sep 25, 2024
nic-6443
nic-6443 previously approved these changes Sep 25, 2024
Comment thread apisix/plugins/jwt-auth.lua Outdated
Comment thread docs/en/latest/plugin-develop.md Outdated
Comment thread apisix/plugins/jwt-auth.lua Outdated
Comment thread apisix/plugins/jwt-auth.lua Outdated
Comment thread apisix/plugins/jwt-auth.lua Outdated
@dspo
dspo requested review from membphis and moonming September 25, 2024 09:13
Comment thread t/lib/apisix/plugins/jwt-auth.lua
@dspo
dspo requested a review from moonming September 26, 2024 01:41
Comment thread apisix/plugins/jwt-auth.lua
Comment thread t/fips/jwt-auth.t Outdated
Comment thread t/fips/jwt-auth.t Outdated
Comment thread t/fips/jwt-auth.t Outdated
Comment thread t/fips/jwt-auth.t Outdated
Comment thread t/perf/test_http.py Outdated
Comment thread t/plugin/jwt-auth.t
@dspo
dspo requested a review from moonming September 27, 2024 02:55
@dspo

dspo commented Sep 27, 2024

Copy link
Copy Markdown
Contributor Author

@moonming @membphis please review again

@membphis membphis left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

doc Documentation things enhancement New feature or request plugin size:XXL This PR changes 1000+ lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants