From 23cf6c31f7ac8d8a7d2e514b8b2d24be426d80c0 Mon Sep 17 00:00:00 2001 From: antoine lebaud Date: Mon, 22 Apr 2024 21:10:12 +0200 Subject: [PATCH] =?UTF-8?q?=E2=9E=95(backend)=20handle=20JSON=20Object=20S?= =?UTF-8?q?igning=20and=20Encryption=20(JOSE)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit joserfc has been chosen as the dependency to implement a JWKs endpoint in the Django app. While there are several alternatives available such as pyjwt, python-jose, jwcrypto, etc., joserfc has been opted for the following reasons: - Cryptography: Although using only cryptography is feasible, its interface/API is not as user-friendly. - pyjwt: While pyjwt is popular, it lacks support for JWK and JWE, which are essential for the requirements. - python-jose: The latest release of python-jose was in 2021, and the project seems less active compared to other alternatives. - Authlib: Authlib is the second most popular library after pyjwt and seems modern with an active community. However, the parts relevant to the use case were extracted into a relatively new package named joserfc. - joserfc: Although joserfc has fewer stars compared to Authlib, it was extracted from Authlib, which has more than 4k stars, indicating a solid foundation. While the low star count of joserfc might raise concerns about its stability, it is believed to be worth considering its addition. Adding Authlib and refactoring later, once they finish migrating to joserfc, is a possibility to address any potential regressions. One of my concern is that joserfc hasn’t been released in a major version yet. This commit is a work in progress, and further evaluation and testing are needed before finalizing the integration of joserfc into the project. --- src/backend/pyproject.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/src/backend/pyproject.toml b/src/backend/pyproject.toml index 6ced849a..adad041d 100644 --- a/src/backend/pyproject.toml +++ b/src/backend/pyproject.toml @@ -47,6 +47,7 @@ dependencies = [ "nested-multipart-parser==1.5.0", "psycopg[binary]==3.1.18", "PyJWT==2.8.0", + "joserfc==0.9.0", "requests==2.31.0", "sentry-sdk==1.45.0", "url-normalize==1.4.3",