VERSION_HISTORY.md raw

jwt-go Version History

4.0.0

3.2.2

3.2.1

* Changed the import path from github.com/dgrijalva/jwt-go to github.com/golang-jwt/jwt

3.2.0

3.1.0

3.0.0

* Dropped support for []byte keys when using RSA signing methods. This convenience feature could contribute to security vulnerabilities involving mismatched key types with signing methods. * ParseFromRequest has been moved to request subpackage and usage has changed * The Claims property on Token is now type Claims instead of map[string]interface{}. The default value is type MapClaims, which is an alias to map[string]interface{}. This makes it possible to use a custom type when decoding claims.

* Added Claims interface type to allow users to decode the claims into a custom type * Added ParseWithClaims, which takes a third argument of type Claims. Use this function instead of Parse if you have a custom type you'd like to decode into. * Dramatically improved the functionality and flexibility of ParseFromRequest, which is now in the request subpackage * Added ParseFromRequestWithClaims which is the FromRequest equivalent of ParseWithClaims * Added new interface type Extractor, which is used for extracting JWT strings from http requests. Used with ParseFromRequest and ParseFromRequestWithClaims. * Added several new, more specific, validation errors to error type bitmask * Moved examples from README to executable example files * Signing method registry is now thread safe * Added new property to ValidationError, which contains the raw error returned by calls made by parse/verify (such as those returned by keyfunc or json parser)

2.7.0

This will likely be the last backwards compatible release before 3.0.0, excluding essential bug fixes.

2.6.0

2.5.0

2.4.0

* You can now specify a list of valid signing methods. Anything outside this set will be rejected. * You can now opt to use the json.Number type instead of float64 when parsing token JSON

2.3.0

2.2.0

2.1.0

Backwards compatible API change that was missed in 2.0.0.

2.0.0

There were two major reasons for breaking backwards compatibility with this update. The first was a refactor required to expand the width of the RSA and HMAC-SHA signing implementations. There will likely be no required code changes to support this change.

The second update, while unfortunately requiring a small change in integration, is required to open up this library to other signing methods. Not all keys used for all signing methods have a single standard on-disk representation. Requiring []byte as the type for all keys proved too limiting. Additionally, this implementation allows for pre-parsed tokens to be reused, which might matter in an application that parses a high volume of tokens with a small set of keys. Backwards compatibilty has been maintained for passing []byte to the RSA signing methods, but they will also accept *rsa.PublicKey and *rsa.PrivateKey.

It is likely the only integration change required here will be to change func(t *jwt.Token) ([]byte, error) to func(t *jwt.Token) (interface{}, error) when calling Parse.

`SigningMethodHS256` is now `SigningMethodHMAC instead of type struct` `SigningMethodRS256` is now `SigningMethodRSA instead of type struct` * KeyFunc now returns interface{} instead of []byte * SigningMethod.Sign now takes interface{} instead of []byte for the key * SigningMethod.Verify now takes interface{} instead of []byte for the key

* Added public package global SigningMethodHS256 * Added public package global SigningMethodHS384 * Added public package global SigningMethodHS512

* Added public package global SigningMethodRS256 * Added public package global SigningMethodRS384 * Added public package global SigningMethodRS512

1.0.2

1.0.1

1.0.0