feat(auth): verify id token #3516
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3516 +/- ##
==========================================
- Coverage 95.78% 95.67% -0.11%
==========================================
Files 120 125 +5
Lines 4820 4999 +179
==========================================
+ Hits 4617 4783 +166
- Misses 203 216 +13 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
src/auth/src/credentials/idtoken.rs
Outdated
|
|
||
| impl Verifier { | ||
| /// Sets the audience for the token verification. | ||
| pub fn with_audience<S: Into<String>>(mut self, audience: S) -> Self { |
There was a problem hiding this comment.
It is a bit odd that I can set the audience, but not clear the audience.
Should we separate this to a builder and once built we disable all functions to change the audience, email or clock skew?
| let response = client | ||
| .get(jwks_url) | ||
| .send() | ||
| .await | ||
| .map_err(|e| crate::errors::from_http_error(e, "failed to fetch JWK set"))?; |
There was a problem hiding this comment.
Do we need a retry loop? Do we need to cache the reqwest client (not if these calls are rare)?
There was a problem hiding this comment.
yeah, adding retries is a good call, but I was planning to add retries to all id token related features later, to reduce the amount of things to be reviewed first.
There was a problem hiding this comment.
Then file a bug (maybe a sub-issue) and add a comment like // TODO(#...) - add a retry loop.
| let response = client | ||
| .get(jwks_url) | ||
| .send() | ||
| .await | ||
| .map_err(|e| crate::errors::from_http_error(e, "failed to fetch JWK set"))?; |
There was a problem hiding this comment.
yeah, adding retries is a good call, but I was planning to add retries to all id token related features later, to reduce the amount of things to be reviewed first.
3 participants
Implement verify id token function, per https://google.aip.dev/auth/4116#expected-behavior-for-verifying-id-tokens
Towards #3449