Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ func initParams() *jwt.GinJWTMiddleware {

IdentityHandler: identityHandler(),
Authenticator: authenticator(),
Authorizator: authorizator(),
Authorizer: authorizator(),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

For consistency with the refactoring to Authorizer, the example function authorizator() should also be renamed to authorizer(). This would involve updating both the function call here and its definition on line 235. I've also adjusted the spacing in the suggestion to align this field with the others.

Suggested change
Authorizer: authorizator(),
Authorizer: authorizer(),

Unauthorized: unauthorized(),
TokenLookup: "header: Authorization, query: token, cookie: jwt",
// TokenLookup: "query:token",
Expand Down Expand Up @@ -662,13 +662,13 @@ Signature: `func(c *gin.Context, token *core.Token)`

PROVIDED: `MiddlewareFunc`

This is gin middleware that should be used within any endpoints that require the jwt token to be present. This middleware will parse the request headers for the token if it exists, and check that the jwt token is valid (not expired, correct signature). Then it will call `IdentityHandler` followed by `Authorizator`. If `Authorizator` passes and all of the previous token validity checks passed, the middleware will continue the request. If any of these checks fail, the `Unauthorized` function is used (explained below).
This is gin middleware that should be used within any endpoints that require the jwt token to be present. This middleware will parse the request headers for the token if it exists, and check that the jwt token is valid (not expired, correct signature). Then it will call `IdentityHandler` followed by `Authorizer`. If `Authorizer` passes and all of the previous token validity checks passed, the middleware will continue the request. If any of these checks fail, the `Unauthorized` function is used (explained below).

OPTIONAL: `IdentityHandler`

The default of this function is likely sufficient for your needs. The purpose of this function is to fetch the user identity from claims embedded within the jwt token, and pass this identity value to `Authorizator`. This function assumes [`IdentityKey`: some_user_identity] is one of the attributes embedded within the claims of the jwt token (determined by `PayloadFunc`).
The default of this function is likely sufficient for your needs. The purpose of this function is to fetch the user identity from claims embedded within the jwt token, and pass this identity value to `Authorizer`. This function assumes [`IdentityKey`: some_user_identity] is one of the attributes embedded within the claims of the jwt token (determined by `PayloadFunc`).

OPTIONAL: `Authorizator`
OPTIONAL: `Authorizer`

Given the user identity value (`data` parameter) and the gin context, this function should check if the user is authorized to be reaching this endpoint (on the endpoints where the `MiddlewareFunc` applies). This function should likely use `ExtractClaims` to check if the user has the sufficient permissions to reach this endpoint, as opposed to hitting the database on every request. This function should return true if the user is authorized to continue through with the request, or false if they are not authorized (where `Unauthorized` will be called).

Expand Down
4 changes: 2 additions & 2 deletions README.zh-CN.md
Original file line number Diff line number Diff line change
Expand Up @@ -500,13 +500,13 @@ CookieSameSite: http.SameSiteDefaultMode, // SameSiteDefaultMode, SameSiteLaxM

- 从 header/cookie/query 解析 Token
- 验证 Token
- 调用 `IdentityHandler` 与 `Authorizator`
- 调用 `IdentityHandler` 与 `Authorizer`
- 验证失败则调用 `Unauthorized`

- **可选:** `IdentityHandler`
从 JWT Claims 获取用户身份。

- **可选:** `Authorizator`
- **可选:** `Authorizer`
检查用户是否有权限访问该端点。

---
Expand Down
4 changes: 2 additions & 2 deletions README.zh-TW.md
Original file line number Diff line number Diff line change
Expand Up @@ -500,13 +500,13 @@ CookieSameSite: http.SameSiteDefaultMode, // SameSiteDefaultMode, SameSiteLaxM

- 從 header/cookie/query 解析 Token
- 驗證 Token
- 呼叫 `IdentityHandler` 與 `Authorizator`
- 呼叫 `IdentityHandler` 與 `Authorizer`
- 驗證失敗則呼叫 `Unauthorized`

- **可選:** `IdentityHandler`
從 JWT Claims 取得使用者身份。

- **可選:** `Authorizator`
- **可選:** `Authorizer`
檢查使用者是否有權限存取該端點。

---
Expand Down
2 changes: 1 addition & 1 deletion _example/basic/server.go
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ func initParams() *jwt.GinJWTMiddleware {

IdentityHandler: identityHandler(),
Authenticator: authenticator(),
Authorizator: authorizator(),
Authorizer: authorizator(),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To maintain consistency with the Authorizer field name, it's recommended to also rename the authorizator() function to authorizer(). You would need to update its definition on line 136 as well. I've adjusted the spacing in the suggestion to maintain alignment with the other fields.

Suggested change
Authorizer: authorizator(),
Authorizer: authorizer(),

Unauthorized: unauthorized(),
LogoutResponse: logoutResponse(),
TokenLookup: "header: Authorization, query: token, cookie: jwt",
Expand Down
2 changes: 1 addition & 1 deletion _example/redis_simple/main.go
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ func main() {
return nil, jwt.ErrFailedAuthentication
},

Authorizator: func(c *gin.Context, data any) bool {
Authorizer: func(c *gin.Context, data any) bool {
if v, ok := data.(*User); ok && v.UserName == "admin" {
return true
}
Expand Down
2 changes: 1 addition & 1 deletion _example/redis_store/main.go
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ func main() {

return nil, jwt.ErrFailedAuthentication
},
Authorizator: func(c *gin.Context, data any) bool {
Authorizer: func(c *gin.Context, data any) bool {
if v, ok := data.(*User); ok && v.UserName == "admin" {
return true
}
Expand Down
8 changes: 4 additions & 4 deletions auth_jwt.go
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ type GinJWTMiddleware struct {
// Callback function that should perform the authorization of the authenticated user. Called
// only after an authentication success. Must return true on success, false on failure.
// Optional, default to success.
Authorizator func(c *gin.Context, data any) bool
Authorizer func(c *gin.Context, data any) bool

// Callback function that will be called during login.
// Using this function it is possible to add additional payload data to the webtoken.
Expand Down Expand Up @@ -382,8 +382,8 @@ func (mw *GinJWTMiddleware) MiddlewareInit() error {
mw.TokenHeadName = "Bearer"
}

if mw.Authorizator == nil {
mw.Authorizator = func(c *gin.Context, data any) bool {
if mw.Authorizer == nil {
mw.Authorizer = func(c *gin.Context, data any) bool {
return true
}
}
Expand Down Expand Up @@ -520,7 +520,7 @@ func (mw *GinJWTMiddleware) middlewareImpl(c *gin.Context) {
c.Set(mw.IdentityKey, identity)
}

if !mw.Authorizator(c, identity) {
if !mw.Authorizer(c, identity) {
mw.unauthorized(c, http.StatusForbidden, mw.HTTPStatusMessageFunc(c,ErrForbidden))
return
}
Expand Down
18 changes: 9 additions & 9 deletions auth_jwt_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -258,7 +258,7 @@ func TestLoginHandler(t *testing.T) {
Realm: "test zone",
Key: key,
PayloadFunc: func(data any) jwt.MapClaims {
// Set custom claim, to be checked in Authorizator method
// Set custom claim, to be checked in Authorizer method
return jwt.MapClaims{"testkey": "testval", "exp": 0}
},
Authenticator: func(c *gin.Context) (any, error) {
Expand All @@ -273,7 +273,7 @@ func TestLoginHandler(t *testing.T) {
}
return "", ErrFailedAuthentication
},
Authorizator: func(c *gin.Context, user any) bool {
Authorizer: func(c *gin.Context, user any) bool {
return true
},
LoginResponse: func(c *gin.Context, token *core.Token) {
Expand Down Expand Up @@ -667,15 +667,15 @@ func TestExpiredTokenOnRefreshHandler(t *testing.T) {
}
}

func TestAuthorizator(t *testing.T) {
func TestAuthorizer(t *testing.T) {
// the middleware to test
authMiddleware, _ := New(&GinJWTMiddleware{
Realm: "test zone",
Key: key,
Timeout: time.Hour,
MaxRefresh: time.Hour * 24,
Authenticator: defaultAuthenticator,
Authorizator: func(c *gin.Context, data any) bool {
Authorizer: func(c *gin.Context, data any) bool {
return data.(string) == "admin"
},
})
Expand Down Expand Up @@ -752,7 +752,7 @@ func TestClaimsDuringAuthorization(t *testing.T) {
case "Guest":
testkey = ""
}
// Set custom claim, to be checked in Authorizator method
// Set custom claim, to be checked in Authorizer method
now := time.Now()
return jwt.MapClaims{
"identity": data.(string),
Expand Down Expand Up @@ -782,7 +782,7 @@ func TestClaimsDuringAuthorization(t *testing.T) {

return "Guest", ErrFailedAuthentication
},
Authorizator: func(c *gin.Context, user any) bool {
Authorizer: func(c *gin.Context, user any) bool {
jwtClaims := ExtractClaims(c)

if jwtClaims["identity"] == "administrator" {
Expand Down Expand Up @@ -1150,7 +1150,7 @@ func TestSendAuthorizationBool(t *testing.T) {
MaxRefresh: time.Hour * 24,
Authenticator: defaultAuthenticator,
SendAuthorization: true,
Authorizator: func(c *gin.Context, data any) bool {
Authorizer: func(c *gin.Context, data any) bool {
return data.(string) == "admin"
},
})
Expand Down Expand Up @@ -1188,7 +1188,7 @@ func TestExpiredTokenOnAuth(t *testing.T) {
MaxRefresh: time.Hour * 24,
Authenticator: defaultAuthenticator,
SendAuthorization: true,
Authorizator: func(c *gin.Context, data any) bool {
Authorizer: func(c *gin.Context, data any) bool {
return data.(string) == "admin"
},
TimeFunc: func() time.Time {
Expand Down Expand Up @@ -1456,7 +1456,7 @@ func TestGenerateTokenPair(t *testing.T) {
"identity": data,
}
},
Authorizator: func(c *gin.Context, data any) bool {
Authorizer: func(c *gin.Context, data any) bool {
return data == "admin"
},
Unauthorized: func(c *gin.Context, code int, message string) {
Expand Down
Loading