re: docs - ideally, yes, but I'd rather get this on a server and then get
the docs going. So, no - not as part of this PR.


On Mon, Mar 3, 2014 at 8:47 AM, Brian J Brennan <notifications@github.com>wrote:

> In app/lib/middleware.js:
>
> > +      return next(new http403('Missing JWT claim: method'))
> > +
> > +    if (''+auth.method.toUpperCase() !== req.method.toUpperCase())
> > +      return next(new http403('`method` does not match: using "'+auth.method+'" token for "'+req.method+'" request'))
> > +
> > +    if (!auth.path)
> > +      return next(new http403('Missing JWT claim: path'))
> > +
> > +    if (auth.path !== req.url)
> > +      return next(new http403('`path` does not match: trying to use token for "'+auth.path+'" on "'+req.url+'"'))
> > +
> > +    const now = Date.now()/1000|0
> > +    if (auth.exp && auth.exp <= now)
> > +      return next(new http403('Token is expired (token expiry: '+auth.exp+', server time: '+now))
> > +
> > +    if (!(/GET|DELETE|HEAD/.exec(req.method))) {
>
> I just did an experiment - as it turns out, it doesn't need to be. nodeactually rejects any requests (by immediately closing the socket) any
> request with an unrecognized method, and it does not recognize lowercase
> method names
>
> const http = require('http')http.createServer(function (req, res) {
>   res.write(req.method)
>   res.end()}).listen(8080, function () {
>   console.log('listening', this.address())})
>
> [image: image]<https://github-camo.global.ssl.fastly.net/563b6b2c66f36bfc9c4faab581ebd817561e6766/68747470733a2f2f692e636c6f756475702e636f6d2f4b784c684e674d46394c2e7468756d622e706e67>
>
> THAT SAID, it probably wouldn't hurt in case node changes behavior in the
> future.
>
> --
> Reply to this email directly or view it on GitHub<https://github.com/mozilla/badgekit-issue/pull/33/files#r10212034>
> .
>



-- 
@chmcavoy <http://twitter.com/chmcavoy>
http://lonelylion.com