devise-jwt 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 30e463b1ff2eee31807c9e08ad02d39e18291a34
-  data.tar.gz: 8d425949dcc6fa52e7f1db7e44eb0743dec4e6f6
+  metadata.gz: 57dbd666a512c877cf3989c9f29d6a5c46467d49
+  data.tar.gz: 63b617a8088adaf8e320a93728147829748b5ec2
 SHA512:
-  metadata.gz: 8e3caeea62311d2731fcabe065cefc2d6e4435b146165dc796038e425832be22aa4f9d28b8f214363c7faa680771a5acdfebff44e391879172b20fa72ab9ae75
-  data.tar.gz: 0f15207820873a6644c2b491223b88f931cac592ae1ba6415350c0b0e048f93bdfbe8aabe1864f68503cee826668b6f93210d6d0f2c4209e3cee18853b8b09ac
+  metadata.gz: d831413c6c9da16087894f95a7988c62e457d75dfdc3b90d8a59255859158ee9e54c67b981dbc0ae5e6ff7e137f426c59f351a16192cc0a8bb690fb5b995ba0d
+  data.tar.gz: f2af5bba7256f2990d6f3be6e553446a5d3bc8e60cf2b0d59a67c2f80f3f878b3ebf9f4d8a0f9afdec940a970468061d239b89f583e4482bed92ee7881d9f387

data/CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/) 
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [0.4.0] - 2017-08-07
+
+### Added
+- Store `exp` in the blacklist strategy to easy cleaning tasks
+
 ## [0.3.0] - 2017-06-07
 ### Fixed
 - Allow configuring request formats to take into account through

data/README.md

@@ -10,7 +10,7 @@
 You can read about which security concerns this library takes into account and about JWT generic secure usage in the following series of posts:
 
 - [Stand Up for JWT Revocation](http://waiting-for-dev.github.io/blog/2017/01/23/stand_up_for_jwt_revocation/)
-- [JWT Recovation Strategies](http://waiting-for-dev.github.io/blog/2017/01/24/jwt_revocation_strategies/)
+- [JWT Revocation Strategies](http://waiting-for-dev.github.io/blog/2017/01/24/jwt_revocation_strategies/)
 - [JWT Secure Usage](http://waiting-for-dev.github.io/blog/2017/01/25/jwt_secure_usage/)
 - [A secure JWT authentication implementation for Rack and Rails](http://waiting-for-dev.github.io/blog/2017/01/26/a_secure_jwt_authentication_implementation_for_rack_and_rails/)
 
@@ -21,7 +21,7 @@ You can read about which security concerns this library takes into account and a
 Add this line to your application's Gemfile:
 
 ```ruby
-gem 'devise-jwt', '~> 0.1.1'
+gem 'devise-jwt', '~> 0.3.0'
 ```
 
 And then execute:
@@ -60,6 +60,8 @@ You have to tell which user models you want to be able to authenticate with JWT
 - The client can use this token to authenticate following requests for the same user, providing it in the `Authorization` request header, also with format `Bearer #{token}`
 - When the client visits devise destroy session request, the token is revoked.
 
+See [request_formats](#request_formats) configuration option if you are using paths with a format segment (like `.json`) in order to use it properly.
+
 As you see, unlike other JWT authentication libraries, it is expected that tokens will be revoked by the server. I wrote about [why I think JWT revocation is needed and useful](http://waiting-for-dev.github.io/blog/2017/01/23/stand_up_for_jwt_revocation/).
 
 An example configuration:
@@ -79,9 +81,11 @@ def jwt_payload
 end
 ```
 
+Note: if you are making cross-domain requests, make sure that you add `Authorization` header to the list of allowed request headers and exposed response headers. You can use something like [rack-cors](https://github.com/cyu/rack-cors) for that.
+
 ### Revocation strategies
 
-`devise-jwt` comes with two revocation strategies out of the box. They are implementations of what is discussed in the blog post [JWT Recovation Strategies](http://waiting-for-dev.github.io/blog/2017/01/24/jwt_revocation_strategies/), where I also talk about their pros and cons.
+`devise-jwt` comes with two revocation strategies out of the box. They are implementations of what is discussed in the blog post [JWT Revocation Strategies](http://waiting-for-dev.github.io/blog/2017/01/24/jwt_revocation_strategies/), where I also talk about their pros and cons.
 
 #### JTIMatcher
 
@@ -138,13 +142,24 @@ In order to use it, you need to create the blacklist table in a migration:
 def change
   create_table :jwt_blacklist do |t|
     t.string :jti, null: false
+    t.datetime :exp, null: false
   end
   add_index :jwt_blacklist, :jti
 end
 ```
-
 For performance reasons, it is better if the `jti` column is an index.
 
+Note: if you used the blacklist strategy before vesion 0.4.0 you may not have the field *exp.* If not, run the following migration:
+
+```ruby
+class AddExpirationTimeToJWTBlacklist < ActiveRecord::Migration
+  def change
+    add_column :jwt_blacklist, :exp, :datetime, null: false
+  end
+end
+
+```
+
 Then, you need to create the corresponding model and include the strategy:
 
 ```ruby

data/lib/devise/jwt/revocation_strategies/blacklist.rb

@@ -21,7 +21,8 @@ module Devise
 
           # @see Warden::JWTAuth::Interfaces::RevocationStrategy#revoke_jwt
           def self.revoke_jwt(payload, _user)
-            create(jti: payload['jti'])
+            create(jti: payload['jti'],
+                   exp: Time.at(payload['exp'].to_i))
           end
         end
       end

data/lib/devise/jwt/version.rb

@@ -2,6 +2,6 @@
 
 module Devise
   module JWT
-    VERSION = '0.3.0'
+    VERSION = '0.4.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise-jwt
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Marc Busqué
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-06-06 00:00:00.000000000 Z
+date: 2017-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise