github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-06 11:37:49 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2207] [MERGED] fix(auth): remove unnecessary fields from JWT token payloads #3992

New Issue
Closed
opened 2026-03-22 14:58:17 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-22 14:58:17 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2207
Author: @kolaente
Created: 2/8/2026
Status: ✅ Merged
Merged: 2/8/2026
Merged by: @kolaente

Base: main ← Head: fix-remove-unnecessary-jwt-fields

📝 Commits (1)

  • 34bef46 fix(auth): remove unnecessary fields from JWT token payloads

📊 Changes

3 files changed (+0 additions, -16 deletions)

View changed files

📝 frontend/src/stores/auth.ts (+0 -1)
📝 pkg/modules/auth/auth.go (+0 -5)
📝 pkg/user/user.go (+0 -10)

📄 Description

Summary

  • Remove email, name, emailRemindersEnabled, and isLocalUser claims from user JWT tokens
  • Remove isLocalUser claim from link share JWT tokens
  • Simplify GetUserFromClaims to only extract id and username
  • Remove the now-unnecessary email override in the frontend's refreshUserInfo

These fields are never used from the token — the backend always fetches the full user from the database by ID, and the frontend fetches user data from the GET /user API endpoint immediately after login. Existing tokens with the old claims continue to work since extra fields are simply ignored.

Test plan

  • Backend web tests pass
  • go vet and go build pass on changed packages
  • Frontend lint passes
  • Manual login/logout flow works correctly
  • Link share access works correctly

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2207 **Author:** [@kolaente](https://github.com/kolaente) **Created:** 2/8/2026 **Status:** ✅ Merged **Merged:** 2/8/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `fix-remove-unnecessary-jwt-fields` --- ### 📝 Commits (1) - [`34bef46`](https://github.com/go-vikunja/vikunja/commit/34bef46935b08a161146b3585a7661b8b52bbba9) fix(auth): remove unnecessary fields from JWT token payloads ### 📊 Changes **3 files changed** (+0 additions, -16 deletions) <details> <summary>View changed files</summary> 📝 `frontend/src/stores/auth.ts` (+0 -1) 📝 `pkg/modules/auth/auth.go` (+0 -5) 📝 `pkg/user/user.go` (+0 -10) </details> ### 📄 Description ## Summary - Remove `email`, `name`, `emailRemindersEnabled`, and `isLocalUser` claims from user JWT tokens - Remove `isLocalUser` claim from link share JWT tokens - Simplify `GetUserFromClaims` to only extract `id` and `username` - Remove the now-unnecessary email override in the frontend's `refreshUserInfo` These fields are never used from the token — the backend always fetches the full user from the database by ID, and the frontend fetches user data from the `GET /user` API endpoint immediately after login. Existing tokens with the old claims continue to work since extra fields are simply ignored. ## Test plan - [x] Backend web tests pass - [x] `go vet` and `go build` pass on changed packages - [x] Frontend lint passes - [ ] Manual login/logout flow works correctly - [ ] Link share access works correctly --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-22 14:58:17 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#3992
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?