SignedString is an empty string

[bonifaido]

I think there is an issue with the token signing, which is that the value of SignedString is never set (so it is the default empty string) but it is used for signing tokens:

auth/session_storer.go

Line 78 in f21148b

signedToken, _ := token.SignedString([]byte(sessionStorer.SignedString))

[sergolius]

Default SessionStorer obviously has omitted SignedString, it's secret of a session.

auth/auth.go

Lines 88 to 94 in 709ba0c

	if config.SessionStorer == nil {
	config.SessionStorer = &SessionStorer{
	SessionName: "_auth_session",
	SessionManager: manager.SessionManager,
	SigningMethod: jwt.SigningMethodHS256,
	}
	}

You have to define it on your own.

[ghost]

I created a fork of qor where I committed several fixes/pull requests to make it work. Available at, https://github.com/qorpress/qorpress-auth-example