Description
Hi!
The current API allows writing encoding code with a key that does not match the algorithm used, e.g.
let header = Header { alg: Algorithm::RS256, ..Default::default() };
let encoding_key = EncodingKey::from_secret("shared_secret".as_bytes());
let token = encode(&header, &claims, &encoding_key);
This results in an error because the key type does not match the algorithm family.
This kind of error could be caught at compile time.
My proposal is to change the crate's API to catch this kind of error at compile-time instead of runtime, by moving from an enum-based checking to a type-based system.
Here is an overview of the proposed changes:
- Each algorithm family becomes a separated
enum
. - the
Header
struct is changed toHeader<AF>
, taking its algorithm family enum as type parameter, with analgorithm: AF
data member. - similarly, the
EncodingKey
struct is changed toEncodingKey<AF>
, withAF
recorded in aPhantomData
member. - the
encode
function's signature is changed to something like
pub fn encode<T: Serialize, AF>(header: &Header<AF>, claims: &T, key: &EncodingKey<AF>) -> Result<String>
With this approach, code using a key for the wrong algorithm family will no longer compile, and we can get rid of some runtime checks.
On the other hand, you can no longer implement FromStr
for all algorithms families at once. But since one needs to call a different function to generate the key depending on the algorithm family, I don't think this is a huge problem.
Would you be interested in a PR implementing this proposal?