Authentication example is presently harmful

The example is currently equivalent to the “header” example. So there’s no possible value-add it could contribute at the moment.

But unfortunately it is recommending making a ClientInterceptor for sending JWT to the server. That’s not what we recommend. We would recommend using MoreCallCredentials.from(Credential) along with ServiceAccountJwtAccessCredentials (which is Google-centric, but users can potentially use the fromPkcs8() construction method) or to implement CallCredentials directly. CallCredentials has the advantage that the credential 1) can verify its security requirements, like how all JWTs should be sent on an encrypted connection, and 2) will be fresher, as it is called just before the RPC is sent (a waitForReady RPC could be delayed for days).

The example also needs to incorporate how to propagate the authenticated user to the application via Context. Ideally it would at least note how to fail the RPC if the user is unauthenticated. Examples of how to do this is available on SO.

I’m considering deleting the example for the upcoming v1.21.0 release.

[ejona86]

JsonWebToken itself doesn’t look useful, but JsonWebSignature looks more useful.

Bare minimum:

1. replace ClientInterceptor with a ClientCredential
2. include error case of authentication failing with grpc error code of Status.UNAUTHENTICATED
3. propagate authenticated user to application (via Context)
4. either use JWT or name it something else

Nice to haves:

1. Actual JWT, with Bearer prefix
2. Actual verification on server-side, potentially with JsonWebSignature

I’m worried about creating anything on client-side, since we really shouldn’t recommend signing a JWT per-RPC. That implies a cache and thread-safety, yada yada. But that would be fine.

I expect doing “real JWT” to take a while, so I would prefer this to be done in stages. But given this is Friday and the branch cut is on Monday/Tuesday, I expect I will delete the current example for 1.21.0.

[ejona86]

It also is using the Metadata Key name “jwt” for the JWT. However, it seems JWT typically uses the Authentication header with the Bearer prefix.