AuthenticateWithClaims doesn't respect `UnmarshalJSON` implementers

[jhwz]

In sessions.AuthenticateWithClaims you use mapstructure to decode the custom claims into the object.

The call you are using doesn't respect a type implementing the json.Unmarshaler interface. Ideally you would use the standard json library for this, but I understand that it's difficult to implement (may need to unmarshal twice or something). The alternative is to add a DecodeHook to your mapstructure config which handles types which implement json.Unmarshaler

[logan-stytch]

Hey! This is a great suggestion. I'm wondering if something simple like this would hypothetically work:

if unmarshaler, ok := claims.(json.Unmarshaler); ok {
    // use unmarshaler to decode the custom claims
} else {
    // existing unmarshal logic using mapstructure
}

[jhwz]

You don't have the JSON bytes available, just map[string]any.. If you can get the JSON bytes then you should just be using the json package!