o1egl / paseto

Platform-Agnostic Security Tokens implementation in GO (Golang)

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Non-JSON messages

vk-rv opened this issue · comments

commented

Dear Oleg,

Thanks for your work.

Could I trouble you to explain claims encoding:

According to RFC PASETO encodes claims to be transmitted in a JSON.

I mentioned strings and byte slices are accepted "as is" in your library.

The only place where I can find a rationale for that is
https://github.com/paragonie/paseto/tree/master/docs/02-PHP-Library#using-the-protocol-directly

But also I found:
paragonie/paseto#54 (comment)

Is a JSON encoded payload part of the spec? Is it required that (received||sent) payloads are in this format, or optional?

Originally it was going to be optional so people could use Protobuf, etc. However, I've since decided to just use JSON.

I am somewhat confused in the background of the question / implementation.

It looks like PHP version has builder for assembling JSON and special pure routines for advanced optional usage and that is probably mixed in Go case?

Would you be so kind to help me?

Thank you in advance!