JWTAuthMiddlewarenow validates JWT claims using therequired_claimsdecorator and the standardAuthlibvalidation mechanism.Authlibclaim options can be passed to the component using theJWT_CLAIMS_OPTIONSsetting.JWTAuthMiddlewarenow raises an HTTP 403 error ifrequired_claimscheck fails.JWT_ALGORITHMis now a required setting when usingJWTComponent. HS256 is no longer a default and will raise aConfigurationErrorif None.JWT_PRIVATE_KEY_FILEandJWT_PUBLIC_KEY_FILEare now options in settings and are required for RS*, ES*, and PS* algorithms.
- Fixed README.md code examples
- Pinned Authlib version due to API changes in Authlib 0.11
JWTUseris now known asJWTIdentityJWTIdentitynow has dynamic attribute access to its token claims via standard dot notation- Authentication code and components have been relocated to
molten_jwt.auth JWTis now a simple wrapper aroundauthlib.jwtwith no dependencies on themolten.Settings.JWTComponentwill return a single JWT instance configured from the settings passed in themolten.SettingsJWTIdentityComponentnow has a setting to extract a JWTdentity from a json web token passed in a named cookie.JWTAuthMiddlewarenow has new settings to control authentication checking, including a whitelist of handlers.
- Updated documentation before push to Pypi
- Fixed bumpversion replacement string
Switched from using PyJWT to Authlib for JWT support