ueberauth/guardian

This system is a token authentication library for Elixir applications, providing secure session management through JWT-based tokens. It handles token creation, verification, and revocation, while supporting flexible permission encoding and header-based or cookie-based authentication flows. The library also includes utilities for generating secrets and managing dynamic configuration, all wrapped in a modular, behavior-based architecture designed for extensibility and safety.

This period was dominated by a major refactoring of the Guardian library, replacing the Joken backend with JOSE and introducing a modular, behavior-based plug architecture. The update included significant security fixes for token revocation and unbounded atom creation, alongside the addition of new features like permissions and token refreshing.

9 changes

This period focused on expanding the Guardian library's capabilities by introducing full JWT token support, including encoding, decoding, and claim verification. The work also added new permission encoding strategies and a corresponding plug for access control, supported by comprehensive test coverage for these new features.

9 changes

ueberauth/guardian was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point the surveyor at a repository you know and see whether you agree with it.