square/go-jose

It is not possible to configure json decoder when unmarshalling JSONWebToken's claims

narg95 opened this issue · 0 comments

Issue

Currently methods JSONWebToken.Claims and JSONWebToken.UnsafeClaimsWithoutVerification use default json decoding settings and there is no way to modify them e.g. setting Decoder.SetNumberType.

Current workaround

Implementing a custom unmarshal and set decoder settings
e.g.

type MapClaims map[string]interface{}

func (m MapClaims) UnmarshalJSON(b []byte) error {
	d := json.NewDecoder(bytes.NewReader(b))
	// this prevents stack overflow
	mp := map[string]interface{}(m)
	d.SetNumberType(json.UnmarshalIntOrFloat)
	return d.Decode(&mp)
}

Proposed Solutions

Option 1
Create a DecodeOption type that can be passed as a trailing dest arg in variadic func .Claims and .UnsafeClaimsWithoutVerification methods to configure the json decoder

Option 2
Add a DecodingOptions field to JSONWebToken struct that is used to configure JSON decoder in Claims and UnsafeClaimsWithoutVerification methods

Option 3
Global settings? kind of ugly

Option 4
Keep using the workaround

In order of preference I like Options 1 and 2.
Option 1 is very convenient, it does not alter any struct and there is no need to keep any state. The disadvantage is that it is not that obvious, but we can document it.