{"action":"created","issue":{"url":"https://api.github.com/repos/begriffs/postgrest/issues/194","labels_url":"https://api.github.com/repos/begriffs/postgrest/issues/194/labels{/name}","comments_url":"https://api.github.com/repos/begriffs/postgrest/issues/194/comments","events_url":"https://api.github.com/repos/begriffs/postgrest/issues/194/events","html_url":"https://github.com/begriffs/postgrest/pull/194","id":77482923,"number":194,"title":"JWT support","user":{"login":"framp","id":611109,"avatar_url":"https://avatars.githubusercontent.com/u/611109?v=3","gravatar_id":"","url":"https://api.github.com/users/framp","html_url":"https://github.com/framp","followers_url":"https://api.github.com/users/framp/followers","following_url":"https://api.github.com/users/framp/following{/other_user}","gists_url":"https://api.github.com/users/framp/gists{/gist_id}","starred_url":"https://api.github.com/users/framp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/framp/subscriptions","organizations_url":"https://api.github.com/users/framp/orgs","repos_url":"https://api.github.com/users/framp/repos","events_url":"https://api.github.com/users/framp/events{/privacy}","received_events_url":"https://api.github.com/users/framp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-05-18T03:41:20Z","updated_at":"2015-05-20T03:31:10Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/begriffs/postgrest/pulls/194","html_url":"https://github.com/begriffs/postgrest/pull/194","diff_url":"https://github.com/begriffs/postgrest/pull/194.diff","patch_url":"https://github.com/begriffs/postgrest/pull/194.patch"},"body":"Hi guys,\r\n\r\nThis PR brings support for logging in through JSON Web Tokens.\r\nShould close #163.\r\n\r\nWe have a new dependency on `jwt`\r\n\r\nThere is a new option `--jwt-secret secret` which can be used to change the secret used to encryp and decrypt the JWT\r\n\r\nI've added a new route on `POST /postgrest/sessions` which accept `id` and `pass` and returns a JSON Web Token:\r\n\r\n    {\r\n        \"token\": \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYWRtaW5pc3RyYXRvciIsImlkIjoiZnJhbXAifQ.qKwM3TFSrK9eLZ2OvR9p1yMWwx32QoMgw2KANgBGtv4\"\r\n    }\r\n\r\nOr:\r\n\r\n    {\r\n        \"message\": \"Failed authentication.\"\r\n    }\r\n\r\n\r\nAdding a \r\n\r\n    Authorization:Bearer JWT_TOKEN\r\n to a request (with a valid JWT token of course) will authenticate the user.\r\n\r\nI've made a couple of changes on how the config is passed across the application: now `authenticated` and `app` have full access to config (which was needed to pass the secret around).\r\n\r\nI've also upgraded hasql and hasql-postgres as they were failing the circle build.\r\n\r\nLooking at the future, the next step could be adding support for a `iat` (creation timestamp) and `exp` (expiration timestamp).\r\n\r\nAs an aside note: I'm working with GHC 7.10 and the test suite can't run without temporarily disabling `-Werror` (we have a couple of warnings - more specifically the imports marked with `--7.10 redundant` are redundant). \r\nI didn't fix them because it was out of the scope of the PR and because I'm not sure what's the best way to deal with this problem while maintaining compatibility with previous versions."},"comment":{"url":"https://api.github.com/repos/begriffs/postgrest/issues/comments/103744376","html_url":"https://github.com/begriffs/postgrest/pull/194#issuecomment-103744376","issue_url":"https://api.github.com/repos/begriffs/postgrest/issues/194","id":103744376,"user":{"login":"framp","id":611109,"avatar_url":"https://avatars.githubusercontent.com/u/611109?v=3","gravatar_id":"","url":"https://api.github.com/users/framp","html_url":"https://github.com/framp","followers_url":"https://api.github.com/users/framp/followers","following_url":"https://api.github.com/users/framp/following{/other_user}","gists_url":"https://api.github.com/users/framp/gists{/gist_id}","starred_url":"https://api.github.com/users/framp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/framp/subscriptions","organizations_url":"https://api.github.com/users/framp/orgs","repos_url":"https://api.github.com/users/framp/repos","events_url":"https://api.github.com/users/framp/events{/privacy}","received_events_url":"https://api.github.com/users/framp/received_events","type":"User","site_admin":false},"created_at":"2015-05-20T03:31:10Z","updated_at":"2015-05-20T03:31:10Z","body":"The reasoning behind `POST /postgrest/sessions` is that you're creating a new session for the user (and because it's the same path rails and other popular web frameworks used).\r\n\r\nDisabling login with the default key sounds like a considerate choice.\r\nI'm explicitly banning the default \"secret\" as this is the default string suggested by jwt.io\r\n\r\n"}}