auth/jwt: prevent concurrent reads and writes on MapClaims

[peterbourgon]

Closes #562.

[litriv]

@peterbourgon looks like the test is in place and working (failing). What do you think of passing a claim factory to NewParser, that can be be used to create a new jwt.Claims, as in

func NewParser(keyFunc jwt.Keyfunc, method jwt.SigningMethod, newClaims func() claims jwt.Claims) endpoint.Middleware {
    return func(next endpoint.Endpoint) endpoint.Endpoint {
        return func(ctx context.Context, request interface{}) (response interface{}, err error) {
    ...
    token, err := jwt.ParseWithClaims(tokenString, newClaims(), func(token *jwt.Token) 
    (interface{}, error) {
        ...
    })
    ...
}

If agreed, then I will make the change, test my side and commit to this pull request if you are too busy?

[peterbourgon]

Yes, sorry, I got the failing test but then failed to find the time to fix it ;)

That's exactly what's needed. Probably best to define a new type ClaimFactory func(...) jwt.Claim, take one in the constructor, and probably provide a default EmptyClaimFactory implementation — or whatever would be most appropriate, I'm not a JWT expert.

[litriv]

@peterbourgon sounds about right. I'm on it 👍

[litriv]

@peterbourgon this is now fixed. how shall i go about getting the changes to the repo? probably easiest if you can give me temporary write access so i can just push to this branch?

[basvanbeek]

why not just fork it to your account and submit a new PR referencing this one?

[litriv]

@basvanbeek i created a pull request to merge with this branch, but if it's better to create one for merging with master, then let me know and i'll do it. thanks

[B3rs]

Hi @peterbourgon, I just encountered the same problem, any clue on when this PR will be merged into master? thanks

[peterbourgon]

How about now?