Claims Validation

[jamesstonehill]

In an effort to make the claim validation a little more extendable and to fix this issue, I've added a ClaimsValidator class that is responsible for validating validatable claims.

I thought that it is a little inconsistent that we only validate the exp claim is an integer even though the JWT RFC mandates that all time (iat, nbf, and exp) claims "MUST be a number containing a NumericDate value".

[sourcelevel-bot]

Hello, @jamesstonehill! This is your first Pull Request that will be reviewed by Ebert, an automatic Code Review service. It will leave comments on this diff with potential issues and style violations found in the code as you push new commits. You can also see all the issues found on this Pull Request on its review page. Please check our documentation for more information.

[sourcelevel-bot]

Use %i or %I for an array of symbols.

[sourcelevel-bot]

Freeze mutable objects assigned to constants.

[jamesstonehill]

@excpt seems like the specs are failing for 2.2 because of a dependency mismatch with openssl

[sourcelevel-bot]

Ebert has finished reviewing this Pull Request and has found:

• 3 possible new issues (including those that may have been commented here).
• 2 fixed issues! 🎉

But beware that this branch is 13 commits behind the jwt:master branch, and a review of an up to date branch would produce more accurate results.

You can see more details about this review at https://ebertapp.io/github/jwt/ruby-jwt/pulls/287.

[excpt]

Thanks again!

[anakinj]

I think this would be a nice addition, to separate the validation from the encoding logic.

Added one minor issue with the validation, might be worth checking out.

[anakinj]

You have to check that the key actually is present in the payload, this row is now checking if the value returned from the hash is thruthy.

I think this will not validate cases where exp is false or nil eg:

{ exp: false }

[jamesstonehill]

Good catch

[jamesstonehill]

Switching branches to this one for a cleaner commit history. #295