{"action":"created","issue":{"url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/392","labels_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/392/labels{/name}","comments_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/392/comments","events_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/392/events","html_url":"https://github.com/tymondesigns/jwt-auth/issues/392","id":126800170,"number":392,"title":"Working without sessions","user":{"login":"aejnsn","id":5347897,"avatar_url":"https://avatars.githubusercontent.com/u/5347897?v=3","gravatar_id":"","url":"https://api.github.com/users/aejnsn","html_url":"https://github.com/aejnsn","followers_url":"https://api.github.com/users/aejnsn/followers","following_url":"https://api.github.com/users/aejnsn/following{/other_user}","gists_url":"https://api.github.com/users/aejnsn/gists{/gist_id}","starred_url":"https://api.github.com/users/aejnsn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aejnsn/subscriptions","organizations_url":"https://api.github.com/users/aejnsn/orgs","repos_url":"https://api.github.com/users/aejnsn/repos","events_url":"https://api.github.com/users/aejnsn/events{/privacy}","received_events_url":"https://api.github.com/users/aejnsn/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-01-15T03:23:14Z","updated_at":"2016-01-18T06:02:11Z","closed_at":"2016-01-15T08:19:00Z","body":"I am constructing a backend API (no need for sessions) that will communicate via JWT. I see in the classes within Tymon\\JWTAuth\\Providers\\Auth that sessions are necessary in order to retrieve the user. However, JWT authentication is premised upon being stateless, yet this package is using sessions (state) in order to retrieve the current user."},"comment":{"url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/comments/172433369","html_url":"https://github.com/tymondesigns/jwt-auth/issues/392#issuecomment-172433369","issue_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/392","id":172433369,"user":{"login":"aejnsn","id":5347897,"avatar_url":"https://avatars.githubusercontent.com/u/5347897?v=3","gravatar_id":"","url":"https://api.github.com/users/aejnsn","html_url":"https://github.com/aejnsn","followers_url":"https://api.github.com/users/aejnsn/followers","following_url":"https://api.github.com/users/aejnsn/following{/other_user}","gists_url":"https://api.github.com/users/aejnsn/gists{/gist_id}","starred_url":"https://api.github.com/users/aejnsn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aejnsn/subscriptions","organizations_url":"https://api.github.com/users/aejnsn/orgs","repos_url":"https://api.github.com/users/aejnsn/repos","events_url":"https://api.github.com/users/aejnsn/events{/privacy}","received_events_url":"https://api.github.com/users/aejnsn/received_events","type":"User","site_admin":false},"created_at":"2016-01-18T06:02:11Z","updated_at":"2016-01-18T06:02:11Z","body":"I don't know if I expressed my idea as much as I griped about the gist with bad code in my last post. Auth is just one of Laravel's facades, and I am not proposing the wholesale removal of the reliance on an external authentication facility. I am proposing only the removal of the reliance upon the authentication facility (Guard/Senintel) to store the current user within its state/life cycle upon authentication. This can be achieved through restructuring the AuthInterface (its implementations and consumption patterns), and thus persisting the current user somewhere within JWTAuth's state.\r\n\r\nIt's not so minor in the grand scheme of writing defensive code. Because of AuthInterface's implementations, and how instances thereof are consumed, it allows the stateless nature of JWT to be violated. I think this would be a good improvement, and I definitely consider this an area where a JWT library should be opinionated. The more I think about it, this might not be a good fit for jwt-auth. I don't care for the project's branching and release history."}}