Upgrade to axum 0.8 + tower-http 0.6, accept float NumericDate, add Validation::validate_aud(bool)#66
Open
georgeboot wants to merge 5 commits into
Open
Upgrade to axum 0.8 + tower-http 0.6, accept float NumericDate, add Validation::validate_aud(bool)#66georgeboot wants to merge 5 commits into
georgeboot wants to merge 5 commits into
Conversation
Mirrors jsonwebtoken's own validate_aud toggle. When set to false the aud claim is ignored even if present, so callers don't need to maintain an allowlist of client IDs when the issuer is the only thing they care about.
- Add OptionalFromRequestParts impl for JwtClaims so Option<JwtClaims<T>> extraction works under axum 0.8 (blanket impl was removed), and restore the extract_from_public_optional test. - Drop dead #[allow(dead_code)] and unused serde::de::Error import from the NumericDate deserializer. - Add tests for NumericDate int/float deserialization and for Validation::validate_aud(false). - CHANGELOG entries for the three new features on this branch.
tower-http 0.5 still pulls base64 0.21, which causes duplication for downstreams that have moved on to base64 0.22 via more modern http-stack crates. 0.6 went out in October 2024 with no API breakage that affects our usage (we only use the `trace` + `auth` features). All 14 unit tests + 3 doctests pass unchanged.
georgeboot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Four independent changes bundled together:
axumto0.8.1in bothjwt-authorizeranddemo-server, drops#[async_trait]. Adds anOptionalFromRequestPartsimpl forJwtClaims<T>since axum 0.8 removed the blanketOption<T>extractor impl.NumericDateaccepts floats. Some issuers emitexp/nbf/iatas floating-point JSON numbers. RFC 7519 §2 allows it, so deserialize via an untagged enum and cast toi64.Validation::validate_aud(bool). New builder method that disables theaudcheck entirely. Useful when you trust the issuer and don't want to maintain an allowlist of client IDs.tower-http0.5 → 0.6. Small dep cleanup — 0.5 still pullsbase64 0.21, so downstreams that have moved on to 0.22 via other paths end up carrying two copies. No API changes affect this crate (we only use thetrace+authfeatures).We've been running these changes in our own fork for more than a year, and figured we should just try to get them upstreamed.
Test plan
cargo build --all-featurescargo test --all-features(49 passed, including newextract_from_public_optional,numeric_date_accepts_int_and_float,validate_aud_disabled)