Relying on a stale package such as `github.com/coreos/go-oidc.v1` is really annoying for a
security product.
Moreover, this library has no support for tokens with an EC signature.
I've tried a bit to remove this but I felt like the choice of a proper library should
be discussed.
Here is my two cents:
- coreos/go-oidc.v2 does not add much compared to stdlib `x/oauth2`: there is remote
JWKS fetcher which might be useful, although this is in fact `square/go-jose` that does
the heavy lifting here
- I found `square/go-jose` good enough for JWK and JWKS, but rather unpractical for
JWT. I found `dgrijalva/jwt-go` much handier when it comes to manipulate JWT
Any ideas / challenges around for a proper choice of dependencies here?
Cheers,
Frédéric
frederic.bidon(a)yahoo.com