-
Notifications
You must be signed in to change notification settings - Fork 71
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Migrate from python-jose to PyJWT #194
Conversation
Hi! Thank you so much! I'm out for the week, but I'll review as soon as I get back home. |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #194 +/- ##
=======================================
Coverage 100.0% 100.0%
=======================================
Files 6 6
Lines 248 263 +15
=======================================
+ Hits 248 263 +15
|
60603fb
to
d1b2dcd
Compare
Yes, I was missing some checks but seems to be fine now |
Awesome! Thanks again, I really appreciate it😊 I'll get this reviewed/merged early next week. |
I've merged and released, thank you again! |
Hi, I was dealing with some vulnerabilities in a project, and I realized that this package uses
python-jose
. It hasn't been updated since 2021, so makes sense to use another implementation likePyJWT
.You can find the vulnerability here: GHSA-6c5p-j8vq-pqhj.
In the FastAPI security section of the documentation they were using
python-jose
yet it was updated a few days ago: fastapi/fastapi#11589.This PR only adapts the
PyJWT
package wherepython-jose
was used. All tests passed, and I have tested it in my own project. Any feedback is welcomed and hopefully we can include this change in future releases.