Skip to content

Conversation

@AllenAnthes
Copy link
Member

@AllenAnthes AllenAnthes commented Jun 13, 2020

Adds setting to use RS256 key pair for signing JWTs.

This will allow other services (e.g. Resources API) to check the validity of a provided JWT simply by using the public key, verifying it was actually signed by our backend.

Also added a fallback private/public key pair for use during development.

@irvingpop
Copy link
Contributor

The added bits look right - but do the added keys to JWT_AUTH automagically turn something on?

@AllenAnthes
Copy link
Member Author

@irvingpop yep - https://github.com/jpadilla/django-rest-framework-jwt/blob/master/rest_framework_jwt/utils.py#L91

Without a JWT_PRIVATE_KEY defined it falls back to JWT_SECRET_KEY, which itself falls back to the SECRET_KEY

@AllenAnthes AllenAnthes merged commit 26b2cc3 into staging Jun 13, 2020
@AllenAnthes AllenAnthes deleted the jwt-signing-keys branch June 13, 2020 21:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants