JWT (JSON Web Token) authentication

[QuintinWillison]

Lack of support for JWTs is documented under Known Limitations. It's also highlighted in the tests.

Also, the concept of "unimplemented test" was introduced at some point to the backlog. I'm going to close all of these issues as they add no value to the backlog (the work to be done is under this issue) however I am recording them here for reference:

• Unimplemented Test: TestRealtimeConn_RTC8a_ExplicitAuthorizeWhileConnected #408
• Unimplemented Test: TestRealtimeConn_RTC8a_ExplicitAuthorizeWhileConnected RTC8a4 #409

┆Issue is synchronized with this Jira Task by Unito

[sync-by-unito]

➤ Automation for Jira commented:

The link to the corresponding Jira issue is https://ably.atlassian.net/browse/SDK-3139

[SimonWoolf]

It looks like the only missing feature here is that the SDK doesn't handle a content-type of application/jwt as a synonym for text/plain. (After all, the SDK handles text tokens opaquely anyway; it doesn't need to anything special for JWT, it passes it on to the server same as with a legacy token string).

This is hardly essential; until that's implemented the customer can just have their auth server return encoded jwts with a content-type of text/plain.

I think listing "JWT authentication using auth-url is not implemented" as a "known limitation" is misleading; customers might be put off using JWTs for no good reason. We should just document the content-type limitation. (Or add support for the extra content-type, surely it's like one line of code)

[lmars]

Or add support for the extra content-type, surely it's like one line of code

Definitely advocate for that...

ably-go/ably/auth.go

Line 463 in 673864c

case "text/plain":

[sacOO7]

Link to internal conversation -> https://ably-real-time.slack.com/archives/CURL4U2FP/p1725031482412929

[sacOO7]

This issue is strongly related to server/client initiated auth.

[sacOO7]

JWT related conversation using echoserver -> https://ably-real-time.slack.com/archives/CURL4U2FP/p1713355380562679