Authenticator: remove jwt.Validate

[drakkan]

jwt.Validate is already called in Verifier, no need to call it twice.

If jwt.Validate fails in Verifier, the error is set in the context and the Authenticator retrieves the token and error from the context.

[VojtechVitek]

LGTM. Makes sense.

Already called in Verifier:

jwtauth/jwtauth.go

Lines 114 to 116 in 127ee7c

	if err := jwt.Validate(token, ja.validateOptions...); err != nil {
	return token, ErrorReason(err)
	}

[rasm685p]

Looking at the Verifier implementation, the if token == nil check seems redundant too since the Verifier middleware already sets an error in the context when the token is nil. Could someone clarify why this check is needed and why it hasn't been removed?

[VojtechVitek]

LGTM.

@klaidliadon this is exactly what we discussed last week.

[rasm685p]

Looking at the Verifier implementation, the if token == nil check seems redundant too since the Verifier middleware already sets an error in the context when the token is nil. Could someone clarify why this check is needed and why it hasn't been removed?

@VojtechVitek Hi! Wondering if my previous message might have slipped through - would really appreciate your thoughts when you have a moment.

[VojtechVitek]

I guess it can happen if someone forgets to apply Verifier middleware or have a custom verifier that returns nil.

[pkieltyka]

please leave the code the way it is for extra safety as Vojtech mentioned