Do not share JWT secret with SQL

2016-09-24 23:40:54 -07:00
parent 71bc666a8e
commit 2f8ac24128
3 changed files with 2 additions and 11 deletions
@@ -194,7 +194,7 @@ CREATE FUNCTION login(id text, pass text) RETURNS public.jwt_token
    LANGUAGE sql SECURITY DEFINER
    AS $$
 SELECT jwt.sign(
-    row_to_json(r), current_setting('postgrest.jwt_secret')
+    row_to_json(r), 'safe'
  ) as token
  FROM (
    SELECT rolname::text, id::text
@@ -227,7 +227,7 @@ CREATE FUNCTION jwt_test() RETURNS public.jwt_token
    LANGUAGE sql SECURITY DEFINER
    AS $$
 SELECT jwt.sign(
-    row_to_json(r), current_setting('postgrest.jwt_secret')
+    row_to_json(r), 'safe'
  ) as token
  FROM (
    SELECT 'joe'::text as iss, 'fun'::text as sub, 'everyone'::text as aud,