Skip to content

Drops deprecated authlib for joserfc: native algorithm allowlist, enforced claims, uv-based packaging. Python 3.10+. - #77

Merged
zyrinx merged 7 commits into
masterfrom
drf-oidc-auth
Oct 8, 2026
Merged

Drops deprecated authlib for joserfc: native algorithm allowlist, enforced claims, uv-based packaging. Python 3.10+.#77
zyrinx merged 7 commits into
masterfrom
drf-oidc-auth

Conversation

@zyrinx

@zyrinx zyrinx commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Drops deprecated authlib for joserfc: native algorithm allowlist, enforced claims, uv-based packaging with auto-publish on release. Python 3.10+.

  • Security: JWT verification now only accepts tokens whose alg is in the new JWT_ALGORITHMS setting (default RS256), unsigned and malformed tokens are rejected before any network call or key lookup, with a 401 instead of a 500.
  • Claims: exp, iat, iss and aud are enforced explicitly through joserfc's claims registry, independent of authlib version-specific leeway semantics that previously could disable expiration checks.
  • Dependencies: authlib removed, joserfc added (the maintained successor, 0 known vulnerabilities).
  • Packaging/CI: pyproject.toml + uv.lock, test matrix on Python 3.10–3.11

Consumers using non-RS256 tokens must set JWT_ALGORITHMS.
Python 3.7–3.9 dropped

Patrick van der Wal added 5 commits October 5, 2026 08:01
Patrick van der Wal
fix: restrict JWT signature verification to configured algorithms
7893ee9
Patrick van der Wal
ci: pin ubuntu-22.04 so python 3.7 stays available
5d59b66
Patrick van der Wal
fix: enforce exp/iat claims and handle joserfc errors with authlib >=…
1f9bf88 
… 1.6
Patrick van der Wal
feat: replace authlib with joserfc and drop python 3.7-3.9 support
4921413 
 - JWT verification now runs on joserfc with a native algorithm allowlist (JWT_ALGORITHMS setting, default RS256)
 - exp/iat/iss/aud claim validation is enforced explicitly
 - packaging moved to pyproject.toml + uv.lock
 - requires-python >= 3.10; malformed tokens return 401 instead of 500
Patrick van der Wal
fix: resolve the jwt signing key lazily so the algorithm gate fires b…
32f470c 
…efore any network call
@zyrinx zyrinx changed the title Drf OIDC auth Drops deprecated authlib for joserfc: native algorithm allowlist, enforced claims, uv-based packaging. Python 3.10+. Oct 5, 2026
tdgroot
tdgroot requested changes Oct 5, 2026
View reviewed changes
Comment thread .github/workflows/python-publish.yml Outdated
tdgroot
tdgroot reviewed Oct 5, 2026
View reviewed changes
Comment thread .github/workflows/test.yaml Outdated
@zyrinx
zyrinx merged commit 63089ee into master Oct 8, 2026
2 checks passed
@tdgroot
tdgroot deleted the drf-oidc-auth branch October 8, 2026 15:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tdgroot tdgroot tdgroot approved these changes
+2 more reviewers
@ikidnapmyself ikidnapmyself ikidnapmyself approved these changes
@martijneichelsheim martijneichelsheim martijneichelsheim approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@zyrinx @tdgroot @ikidnapmyself @martijneichelsheim