♻️ fix!: context key collisions#896
Conversation
|
The FromContext pattern is a lot easier to use! 👍 |
Appears that way. At least in core and contrib. 3rd party middleware were not reviewed. |
|
@ReneWerner87 I created a v3-beta branch, you can merge this into that. (PR set to merge there) |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request addresses context key collisions by using unexported key types, which is a great improvement. However, the new FromContext function in the jwt package introduces a critical bug that can cause a panic. Additionally, the examples in the paseto README demonstrate an unsafe usage of its new FromContext function, which can also lead to panics. I've provided suggestions to fix these issues.
|
@sixcolors can you solve the merge conflicts |
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (2)
Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
Okay done. |
|
/gemini review |
There was a problem hiding this comment.
Pull Request Overview
This PR addresses context key collisions by replacing string-based context keys with unexported typed context keys in both JWT and PASETO middleware packages. The changes prevent potential conflicts when multiple packages store values in the Fiber context using the same string keys.
- Introduces unexported
contextKeytype and typed constants for context storage - Removes configurable
ContextKeyfield from middleware configuration - Adds
FromContexthelper functions for type-safe context value retrieval
Reviewed Changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| jwt/jwt.go | Implements typed context keys and FromContext helper function |
| jwt/config.go | Removes ContextKey configuration field and related logic |
| jwt/config_test.go | Removes test for deprecated ContextKey configuration |
| jwt/jwt_test.go | Adds test for new FromContext function |
| jwt/README.md | Updates documentation to reflect API changes and removes ContextKey references |
| paseto/paseto.go | Implements typed context keys and FromContext helper function |
| paseto/config.go | Removes ContextKey configuration field and related logic |
| paseto/config_test.go | Removes test for deprecated ContextKey configuration |
| paseto/paseto_test.go | Updates tests to use new FromContext function |
| paseto/README.md | Updates documentation to reflect API changes and adds usage examples |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
There was a problem hiding this comment.
Code Review
This pull request correctly addresses context key collisions by using unexported key types for storing data in the context, a recommended practice in Go. The changes are applied to both the jwt and paseto middleware. However, I've identified a critical issue in the jwt package where the new FromContext function can cause a panic if the token is not found in the context. Additionally, the usage examples in the jwt README have not been updated to reflect the API changes, which will lead to runtime panics for users who copy the code. The changes for the paseto package appear to be correct and well-documented.
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request refactors the JWT and Paseto middleware to use unexported context keys, which is a great improvement to prevent key collisions. The implementation is solid and follows Go best practices. My review focuses on improving the documentation to match the code changes and to promote safer usage patterns in the examples. I've pointed out some inconsistencies in the JWT README's configuration table and suggested making the code examples in the Paseto README more robust by adding checks for nil values before type assertions to prevent potential panics.
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
|
@ReneWerner87 | TokenLookup | `string` | TokenLookup is a string in the form of `<source>:<name>` that is used To |
Fixes context key collisions mentioned in issue gofiber/fiber#2684
related to gofiber/fiber#2781
BREAKING CHANGE
Intended for v3