[jwt-play] Having two header name configuration about jwt-scala HOT 5 CLOSED

Another user already reported the problem : #50

I'm not super kind to the idea of introducing a breaking change on the lib for a problem which is more about Akka HTTP than JWT Scala. Keep me updated about the Akka / Play framework team position, I would prefer for everyone to be able to use whatever HTTP headers they want rather than introducing this workaround.

from jwt-scala.

The default behaviour is already broken for now with Play 2.6.

I strongly understand your position about the breaking change.
What about adding just one another configuration key for the server part?

Something like that :

# Header name for the request header where the library can find the JWT token used for the session
# Default : play.http.session.jwtName = "Authorization"
play.http.session.jwtName = "Authorization"

# Header name for the response header name where the library put the JWT token
# Default to the same value as play.http.session.jwtName. 
play.http.session.jwtResponseName = null

And in the source:

 val REQUEST_HEADER_NAME: String = getConfigString("play.http.session.jwtName").getOrElse("Authorization")
 val RESPONSE_HEADER_NAME: String = getConfigString("play.http.session.jwtResponseName").getOrElse(getConfigString("play.http.session.jwtName").getOrElse("Authorization"))

In this way, there are no breaking change, and the new feature is available for the user (like me) of the library who want different headers.

from jwt-scala.

About the issue #50: Sorry I didn't see it, I only looked for open issues.

About your last comment in #50: The RFC7235 defines the Authorization as the valid header to authenticate the client. But nothing (as far as I seen) in RFCs set the Authorization header as invalid for response.

In another hand, we have an example with Cookie (request) and Set-Cookie (response) from RFC6265 and I guess there are other examples for this mechanism.

from jwt-scala.

Ok, we can do that. A test with the PR would be nice but don't spend too much time on it, I can add it quickly after merging.

 val REQUEST_HEADER_NAME: String = getConfigString("play.http.session.jwtName").getOrElse("Authorization")
 val RESPONSE_HEADER_NAME: String = getConfigString("play.http.session.jwtResponseName").orElse(getConfigString("play.http.session.jwtName").getOrElse(REQUEST_HEADER_NAME))

from jwt-scala.

Released in 0.14.0

from jwt-scala.