{"action":"created","issue":{"url":"https://api.github.com/repos/begriffs/postgrest/issues/505","repository_url":"https://api.github.com/repos/begriffs/postgrest","labels_url":"https://api.github.com/repos/begriffs/postgrest/issues/505/labels{/name}","comments_url":"https://api.github.com/repos/begriffs/postgrest/issues/505/comments","events_url":"https://api.github.com/repos/begriffs/postgrest/issues/505/events","html_url":"https://github.com/begriffs/postgrest/issues/505","id":136107358,"number":505,"title":"Accept more than one JWT secret for authentication","user":{"login":"eric-brechemier","id":151276,"avatar_url":"https://avatars.githubusercontent.com/u/151276?v=3","gravatar_id":"","url":"https://api.github.com/users/eric-brechemier","html_url":"https://github.com/eric-brechemier","followers_url":"https://api.github.com/users/eric-brechemier/followers","following_url":"https://api.github.com/users/eric-brechemier/following{/other_user}","gists_url":"https://api.github.com/users/eric-brechemier/gists{/gist_id}","starred_url":"https://api.github.com/users/eric-brechemier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eric-brechemier/subscriptions","organizations_url":"https://api.github.com/users/eric-brechemier/orgs","repos_url":"https://api.github.com/users/eric-brechemier/repos","events_url":"https://api.github.com/users/eric-brechemier/events{/privacy}","received_events_url":"https://api.github.com/users/eric-brechemier/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/begriffs/postgrest/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/begriffs/postgrest/labels/security","name":"security","color":"f9d0c4"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-02-24T16:14:51Z","updated_at":"2016-10-02T17:14:22Z","closed_at":null,"body":"In order to allow a smooth transition from one JWT secret to the next, without invalidating all existing authentication tokens at once, more than one JWT secret should be tried for authentication, typically:\r\n\r\n* the JWT secret currently used for the signature of tokens\r\n* the JWT secret used previously for the signature of tokens\r\n\r\nIn other words, the configuration should allow at least two JWT secrets, one for signature (and authentication), and one or more just for authentication."},"comment":{"url":"https://api.github.com/repos/begriffs/postgrest/issues/comments/250982566","html_url":"https://github.com/begriffs/postgrest/issues/505#issuecomment-250982566","issue_url":"https://api.github.com/repos/begriffs/postgrest/issues/505","id":250982566,"user":{"login":"begriffs","id":911911,"avatar_url":"https://avatars.githubusercontent.com/u/911911?v=3","gravatar_id":"","url":"https://api.github.com/users/begriffs","html_url":"https://github.com/begriffs","followers_url":"https://api.github.com/users/begriffs/followers","following_url":"https://api.github.com/users/begriffs/following{/other_user}","gists_url":"https://api.github.com/users/begriffs/gists{/gist_id}","starred_url":"https://api.github.com/users/begriffs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/begriffs/subscriptions","organizations_url":"https://api.github.com/users/begriffs/orgs","repos_url":"https://api.github.com/users/begriffs/repos","events_url":"https://api.github.com/users/begriffs/events{/privacy}","received_events_url":"https://api.github.com/users/begriffs/received_events","type":"User","site_admin":false},"created_at":"2016-10-02T17:14:22Z","updated_at":"2016-10-02T17:14:22Z","body":"Actually looking at this again is the complexity worth it? What if you just invalidated existing tokens? Then clients would request a new token and continue."}}
{"actor":{"display_login":"begriffs"}}