[GitHub] [couchdb] atrauzzi commented on a change in pull request #2732: Enhance JWT controls (again)

[GitBox <gi...@apache.org>]

atrauzzi commented on a change in pull request #2732: Enhance JWT controls (again)
URL: https://github.com/apache/couchdb/pull/2732#discussion_r400878996
 
 

 ##########
 File path: rel/overlay/etc/default.ini
 ##########
 @@ -142,7 +142,7 @@ max_db_number_for_dbs_info_req = 100
 
 ;[jwt_auth]
 ; List of claims to validate
-; required_claims = exp
+; required_claims = exp,nbf
 
 Review comment:
   I think enforcing anything outside of the spec could surprise or get in the way of some legitimate design that somebody intends for.
   
   My thought is to have the bare minimum out of a zero-configuration setup.  As in, if I run CouchDB and only enable JWTs, they should work.  This is more in the spirit of being easy to get started with and being able to dial in desired configuration incrementally.
   
   That all said, I am open to some degree of caution, without forcing people to implement things that aren't applicable to their system (`nbf` being one potential example of such).

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services