cyberark/slosilo

Consider deprecating `#signed_token`

Opened this issue · 2 comments

It's unclear what purpose Key#signed_token serves. It does not produce a valid JWT token, and the only apparent uses of this method are in tests for slosilo and cyberark/conjur.

This is potentially a good candidate for removal to simply the code and reduce the opportunity for mistakes using this library.

# create a new timestamped and signed token carrying data
def signed_token data
token = { "data" => data, "timestamp" => Time.new.utc.to_s }
token["signature"] = Base64::urlsafe_encode64(sign token)
token["key"] = fingerprint
token
end

FWIW it's a legacy token format I invented before JWT was a thing and AFAIR it was kept for compatibility. IMHO it can go.

@dividedmind

FWIW it's a legacy token format I invented before JWT was a thing and AFAIR it was kept for compatibility. IMHO it can go.

Ah, that's really helpful to know. Thanks so much! 🙂

P.S. I hope you're doing well!