grpc 1.32.0 → 1.52.0

data/src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -1,50 +1,76 @@
-/*
- *
- * Copyright 2015 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
+//
+//
+// Copyright 2015 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
 
 #include <grpc/support/port_platform.h>
 
 #include "src/core/lib/security/credentials/jwt/jwt_verifier.h"
 
 #include <limits.h>
+#include <stdlib.h>
 #include <string.h>
 
-#include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
-#include <grpc/support/sync.h>
+#include <map>
+#include <memory>
+#include <string>
+#include <utility>
+#include <vector>
 
-extern "C" {
+#include <openssl/bio.h>
 #include <openssl/bn.h>
+#include <openssl/crypto.h>
+#include <openssl/evp.h>
 #include <openssl/pem.h>
 #include <openssl/rsa.h>
-}
+#include <openssl/x509.h>
+
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/grpc.h>
+#include <grpc/slice.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+#include <grpc/support/time.h>
 
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/gprpp/manual_constructor.h"
+#include "src/core/lib/gprpp/memory.h"
+#include "src/core/lib/gprpp/orphanable.h"
 #include "src/core/lib/http/httpcli.h"
+#include "src/core/lib/http/httpcli_ssl_credentials.h"
+#include "src/core/lib/http/parser.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/iomgr/polling_entity.h"
+#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/slice/b64.h"
+#include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
+#include "src/core/lib/uri/uri_parser.h"
 #include "src/core/tsi/ssl_types.h"
 
 using grpc_core::Json;
 
-/* --- Utils. --- */
+// --- Utils. ---
 
 const char* grpc_jwt_verifier_status_to_string(
     grpc_jwt_verifier_status status) {
@@ -87,15 +113,14 @@ static Json parse_json_part_from_jwt(const char* str, size_t len) {
     return Json();  // JSON null
   }
   absl::string_view string = grpc_core::StringViewFromSlice(slice);
-  grpc_error* error = GRPC_ERROR_NONE;
-  Json json = Json::Parse(string, &error);
-  if (error != GRPC_ERROR_NONE) {
-    gpr_log(GPR_ERROR, "JSON parse error: %s", grpc_error_string(error));
-    GRPC_ERROR_UNREF(error);
-    json = Json();  // JSON null
+  auto json = Json::Parse(string);
+  grpc_core::CSliceUnref(slice);
+  if (!json.ok()) {
+    gpr_log(GPR_ERROR, "JSON parse error: %s",
+            json.status().ToString().c_str());
+    return Json();  // JSON null
   }
-  grpc_slice_unref_internal(slice);
-  return json;
+  return std::move(*json);
 }
 
 static const char* validate_string_field(const Json& json, const char* key) {
@@ -116,13 +141,13 @@ static gpr_timespec validate_time_field(const Json& json, const char* key) {
   return result;
 }
 
-/* --- JOSE header. see http://tools.ietf.org/html/rfc7515#section-4 --- */
+// --- JOSE header. see http://tools.ietf.org/html/rfc7515#section-4 ---
 
 struct jose_header {
   const char* alg;
   const char* kid;
   const char* typ;
-  /* TODO(jboeuf): Add others as needed (jku, jwk, x5u, x5c and so on...). */
+  // TODO(jboeuf): Add others as needed (jku, jwk, x5u, x5c and so on...).
   grpc_core::ManualConstructor<Json> json;
 };
 static void jose_header_destroy(jose_header* h) {
@@ -133,7 +158,7 @@ static void jose_header_destroy(jose_header* h) {
 static jose_header* jose_header_from_json(Json json) {
   const char* alg_value;
   Json::Object::const_iterator it;
-  jose_header* h = static_cast<jose_header*>(gpr_zalloc(sizeof(jose_header)));
+  jose_header* h = grpc_core::Zalloc<jose_header>();
   if (json.type() != Json::Type::OBJECT) {
     gpr_log(GPR_ERROR, "JSON value is not an object");
     goto error;
@@ -144,12 +169,13 @@ static jose_header* jose_header_from_json(Json json) {
     gpr_log(GPR_ERROR, "Missing alg field.");
     goto error;
   }
-  /* We only support RSA-1.5 signatures for now.
-     Beware of this if we add HMAC support:
-     https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
-   */
+  // We only support RSA-1.5 signatures for now.
+  // Beware of this if we add HMAC support:
+  // https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+  //
   alg_value = it->second.string_value().c_str();
-  if (it->second.type() != Json::Type::STRING || strncmp(alg_value, "RS", 2) ||
+  if (it->second.type() != Json::Type::STRING ||
+      strncmp(alg_value, "RS", 2) != 0 ||
       evp_md_from_alg(alg_value) == nullptr) {
     gpr_log(GPR_ERROR, "Invalid alg field");
     goto error;
@@ -175,10 +201,10 @@ error:
   return nullptr;
 }
 
-/* --- JWT claims. see http://tools.ietf.org/html/rfc7519#section-4.1 */
+// --- JWT claims. see http://tools.ietf.org/html/rfc7519#section-4.1
 
 struct grpc_jwt_claims {
-  /* Well known properties already parsed. */
+  // Well known properties already parsed.
   const char* sub;
   const char* iss;
   const char* aud;
@@ -236,14 +262,13 @@ gpr_timespec grpc_jwt_claims_not_before(const grpc_jwt_claims* claims) {
 }
 
 grpc_jwt_claims* grpc_jwt_claims_from_json(Json json) {
-  grpc_jwt_claims* claims =
-      static_cast<grpc_jwt_claims*>(gpr_zalloc(sizeof(grpc_jwt_claims)));
+  grpc_jwt_claims* claims = grpc_core::Zalloc<grpc_jwt_claims>();
   claims->json.Init(std::move(json));
   claims->iat = gpr_inf_past(GPR_CLOCK_REALTIME);
   claims->nbf = gpr_inf_past(GPR_CLOCK_REALTIME);
   claims->exp = gpr_inf_future(GPR_CLOCK_REALTIME);
 
-  /* Per the spec, all fields are optional. */
+  // Per the spec, all fields are optional.
   for (const auto& p : claims->json->object_value()) {
     if (p.first == "sub") {
       claims->sub = validate_string_field(p.second, "sub");
@@ -301,9 +326,9 @@ grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims* claims,
     return GRPC_JWT_VERIFIER_TIME_CONSTRAINT_FAILURE;
   }
 
-  /* This should be probably up to the upper layer to decide but let's harcode
-     the 99% use case here for email issuers, where the JWT must be self
-     issued. */
+  // This should be probably up to the upper layer to decide but let's harcode
+  // the 99% use case here for email issuers, where the JWT must be self
+  // issued.
   if (grpc_jwt_issuer_email_domain(claims->iss) != nullptr &&
       claims->sub != nullptr && strcmp(claims->iss, claims->sub) != 0) {
     gpr_log(GPR_ERROR,
@@ -326,12 +351,12 @@ grpc_jwt_verifier_status grpc_jwt_claims_check(const grpc_jwt_claims* claims,
   return GRPC_JWT_VERIFIER_OK;
 }
 
-/* --- verifier_cb_ctx object. --- */
+// --- verifier_cb_ctx object. ---
 
 typedef enum {
   HTTP_RESPONSE_OPENID = 0,
   HTTP_RESPONSE_KEYS,
-  HTTP_RESPONSE_COUNT /* must be last */
+  HTTP_RESPONSE_COUNT  // must be last
 } http_response_index;
 
 struct verifier_cb_ctx {
@@ -345,8 +370,9 @@ struct verifier_cb_ctx {
   void* user_data;
   grpc_jwt_verification_done_cb user_cb;
   grpc_http_response responses[HTTP_RESPONSE_COUNT];
+  grpc_core::OrphanablePtr<grpc_core::HttpRequest> http_request;
 };
-/* Takes ownership of the header, claims and signature. */
+// Takes ownership of the header, claims and signature.
 static verifier_cb_ctx* verifier_cb_ctx_create(
     grpc_jwt_verifier* verifier, grpc_pollset* pollset, jose_header* header,
     grpc_jwt_claims* claims, const char* audience, const grpc_slice& signature,
@@ -354,8 +380,7 @@ static verifier_cb_ctx* verifier_cb_ctx_create(
     grpc_jwt_verification_done_cb cb) {
   grpc_core::ApplicationCallbackExecCtx callback_exec_ctx;
   grpc_core::ExecCtx exec_ctx;
-  verifier_cb_ctx* ctx =
-      static_cast<verifier_cb_ctx*>(gpr_zalloc(sizeof(verifier_cb_ctx)));
+  verifier_cb_ctx* ctx = new verifier_cb_ctx();
   ctx->verifier = verifier;
   ctx->pollent = grpc_polling_entity_create_from_pollset(pollset);
   ctx->header = header;
@@ -365,30 +390,30 @@ static verifier_cb_ctx* verifier_cb_ctx_create(
   ctx->signed_data = grpc_slice_from_copied_buffer(signed_jwt, signed_jwt_len);
   ctx->user_data = user_data;
   ctx->user_cb = cb;
-
   return ctx;
 }
 
 void verifier_cb_ctx_destroy(verifier_cb_ctx* ctx) {
   if (ctx->audience != nullptr) gpr_free(ctx->audience);
   if (ctx->claims != nullptr) grpc_jwt_claims_destroy(ctx->claims);
-  grpc_slice_unref_internal(ctx->signature);
-  grpc_slice_unref_internal(ctx->signed_data);
+  grpc_core::CSliceUnref(ctx->signature);
+  grpc_core::CSliceUnref(ctx->signed_data);
   jose_header_destroy(ctx->header);
   for (size_t i = 0; i < HTTP_RESPONSE_COUNT; i++) {
     grpc_http_response_destroy(&ctx->responses[i]);
   }
-  /* TODO: see what to do with claims... */
-  gpr_free(ctx);
+  // TODO(unknown): see what to do with claims...
+  delete ctx;
 }
 
-/* --- grpc_jwt_verifier object. --- */
+// --- grpc_jwt_verifier object. ---
 
-/* Clock skew defaults to one minute. */
+// Clock skew defaults to one minute.
 gpr_timespec grpc_jwt_verifier_clock_skew = {60, 0, GPR_TIMESPAN};
 
-/* Max delay defaults to one minute. */
-grpc_millis grpc_jwt_verifier_max_delay = 60 * GPR_MS_PER_SEC;
+// Max delay defaults to one minute.
+grpc_core::Duration grpc_jwt_verifier_max_delay =
+    grpc_core::Duration::Minutes(1);
 
 struct email_key_mapping {
   char* email_domain;
@@ -396,12 +421,11 @@ struct email_key_mapping {
 };
 struct grpc_jwt_verifier {
   email_key_mapping* mappings;
-  size_t num_mappings; /* Should be very few, linear search ok. */
+  size_t num_mappings;  // Should be very few, linear search ok.
   size_t allocated_mappings;
-  grpc_httpcli_context http_ctx;
 };
 
-static Json json_from_http(const grpc_httpcli_response* response) {
+static Json json_from_http(const grpc_http_response* response) {
   if (response == nullptr) {
     gpr_log(GPR_ERROR, "HTTP response is NULL.");
     return Json();  // JSON null
@@ -411,14 +435,13 @@ static Json json_from_http(const grpc_httpcli_response* response) {
             response->status);
     return Json();  // JSON null
   }
-  grpc_error* error = GRPC_ERROR_NONE;
-  Json json = Json::Parse(
-      absl::string_view(response->body, response->body_length), &error);
-  if (error != GRPC_ERROR_NONE) {
+  auto json =
+      Json::Parse(absl::string_view(response->body, response->body_length));
+  if (!json.ok()) {
     gpr_log(GPR_ERROR, "Invalid JSON found in response.");
     return Json();  // JSON null
   }
-  return json;
+  return std::move(*json);
 }
 
 static const Json* find_property_by_name(const Json& json, const char* name) {
@@ -464,7 +487,7 @@ static BIGNUM* bignum_from_base64(const char* b64) {
   }
   result = BN_bin2bn(GRPC_SLICE_START_PTR(bin),
                      TSI_SIZE_AS_SIZE(GRPC_SLICE_LENGTH(bin)), nullptr);
-  grpc_slice_unref_internal(bin);
+  grpc_core::CSliceUnref(bin);
   return result;
 }
 
@@ -472,10 +495,10 @@ static BIGNUM* bignum_from_base64(const char* b64) {
 
 // Provide compatibility across OpenSSL 1.02 and 1.1.
 static int RSA_set0_key(RSA* r, BIGNUM* n, BIGNUM* e, BIGNUM* d) {
-  /* If the fields n and e in r are NULL, the corresponding input
-   * parameters MUST be non-NULL for n and e.  d may be
-   * left NULL (in case only the public key is used).
-   */
+  // If the fields n and e in r are NULL, the corresponding input
+  // parameters MUST be non-NULL for n and e.  d may be
+  // left NULL (in case only the public key is used).
+  //
   if ((r->n == nullptr && n == nullptr) || (r->e == nullptr && e == nullptr)) {
     return 0;
   }
@@ -533,11 +556,11 @@ static EVP_PKEY* pkey_from_jwk(const Json& json, const char* kty) {
     gpr_log(GPR_ERROR, "Cannot set RSA key from inputs.");
     goto end;
   }
-  /* RSA_set0_key takes ownership on success. */
+  // RSA_set0_key takes ownership on success.
   tmp_n = nullptr;
   tmp_e = nullptr;
   result = EVP_PKEY_new();
-  EVP_PKEY_set1_RSA(result, rsa); /* uprefs rsa. */
+  EVP_PKEY_set1_RSA(result, rsa);  // uprefs rsa.
 
 end:
   RSA_free(rsa);
@@ -548,12 +571,12 @@ end:
 
 static EVP_PKEY* find_verification_key(const Json& json, const char* header_alg,
                                        const char* header_kid) {
-  /* Try to parse the json as a JWK set:
-     https://tools.ietf.org/html/rfc7517#section-5. */
+  // Try to parse the json as a JWK set:
+  // https://tools.ietf.org/html/rfc7517#section-5.
   const Json* jwt_keys = find_property_by_name(json, "keys");
   if (jwt_keys == nullptr) {
-    /* Use the google proprietary format which is:
-       { <kid1>: <x5091>, <kid2>: <x5092>, ... } */
+    // Use the google proprietary format which is:
+    // { <kid1>: <x5091>, <kid2>: <x5092>, ... }
     const Json* cur = find_property_by_name(json, header_kid);
     if (cur == nullptr) return nullptr;
     return extract_pkey_from_x509(cur->string_value().c_str());
@@ -563,8 +586,8 @@ static EVP_PKEY* find_verification_key(const Json& json, const char* header_alg,
             "Unexpected value type of keys property in jwks key set.");
     return nullptr;
   }
-  /* Key format is specified in:
-     https://tools.ietf.org/html/rfc7518#section-6. */
+  // Key format is specified in:
+  // https://tools.ietf.org/html/rfc7518#section-6.
   for (const Json& jkey : jwt_keys->array_value()) {
     if (jkey.type() != Json::Type::OBJECT) continue;
     const char* alg = nullptr;
@@ -600,7 +623,7 @@ static int verify_jwt_signature(EVP_PKEY* key, const char* alg,
   const EVP_MD* md = evp_md_from_alg(alg);
   int result = 0;
 
-  GPR_ASSERT(md != nullptr); /* Checked before. */
+  GPR_ASSERT(md != nullptr);  // Checked before.
   if (md_ctx == nullptr) {
     gpr_log(GPR_ERROR, "Could not create EVP_MD_CTX.");
     goto end;
@@ -626,7 +649,7 @@ end:
   return result;
 }
 
-static void on_keys_retrieved(void* user_data, grpc_error* /*error*/) {
+static void on_keys_retrieved(void* user_data, grpc_error_handle /*error*/) {
   verifier_cb_ctx* ctx = static_cast<verifier_cb_ctx*>(user_data);
   Json json = json_from_http(&ctx->responses[HTTP_RESPONSE_KEYS]);
   EVP_PKEY* verification_key = nullptr;
@@ -654,7 +677,7 @@ static void on_keys_retrieved(void* user_data, grpc_error* /*error*/) {
 
   status = grpc_jwt_claims_check(ctx->claims, ctx->audience);
   if (status == GRPC_JWT_VERIFIER_OK) {
-    /* Pass ownership. */
+    // Pass ownership.
     claims = ctx->claims;
     ctx->claims = nullptr;
   }
@@ -665,16 +688,20 @@ end:
   verifier_cb_ctx_destroy(ctx);
 }
 
-static void on_openid_config_retrieved(void* user_data, grpc_error* /*error*/) {
+static void on_openid_config_retrieved(void* user_data,
+                                       grpc_error_handle /*error*/) {
   verifier_cb_ctx* ctx = static_cast<verifier_cb_ctx*>(user_data);
   const grpc_http_response* response = &ctx->responses[HTTP_RESPONSE_OPENID];
   Json json = json_from_http(response);
-  grpc_httpcli_request req;
+  grpc_http_request req;
+  memset(&req, 0, sizeof(grpc_http_request));
   const char* jwks_uri;
-  grpc_resource_quota* resource_quota = nullptr;
   const Json* cur;
+  absl::StatusOr<grpc_core::URI> uri;
+  char* host;
+  char* path;
 
-  /* TODO(jboeuf): Cache the jwks_uri in order to avoid this hop next time. */
+  // TODO(jboeuf): Cache the jwks_uri in order to avoid this hop next time.
   if (json.type() == Json::Type::JSON_NULL) goto error;
   cur = find_property_by_name(json, "jwks_uri");
   if (cur == nullptr) {
@@ -688,26 +715,30 @@ static void on_openid_config_retrieved(void* user_data, grpc_error* /*error*/) {
     goto error;
   }
   jwks_uri += 8;
-  req.handshaker = &grpc_httpcli_ssl;
-  req.host = gpr_strdup(jwks_uri);
-  req.http.path = const_cast<char*>(strchr(jwks_uri, '/'));
-  if (req.http.path == nullptr) {
-    req.http.path = (char*)"";
+  host = gpr_strdup(jwks_uri);
+  path = const_cast<char*>(strchr(jwks_uri, '/'));
+  if (path == nullptr) {
+    path = const_cast<char*>("");
   } else {
-    *(req.host + (req.http.path - jwks_uri)) = '\0';
+    *(host + (path - jwks_uri)) = '\0';
   }
 
-  /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
-     channel. This would allow us to cancel an authentication query when under
-     extreme memory pressure. */
-  resource_quota = grpc_resource_quota_create("jwt_verifier");
-  grpc_httpcli_get(
-      &ctx->verifier->http_ctx, &ctx->pollent, resource_quota, &req,
-      grpc_core::ExecCtx::Get()->Now() + grpc_jwt_verifier_max_delay,
+  // TODO(ctiller): Carry the resource_quota in ctx and share it with the host
+  // channel. This would allow us to cancel an authentication query when under
+  // extreme memory pressure.
+  uri = grpc_core::URI::Create("https", host, path, {} /* query params /*/,
+                               "" /* fragment */);
+  if (!uri.ok()) {
+    goto error;
+  }
+  ctx->http_request = grpc_core::HttpRequest::Get(
+      std::move(*uri), nullptr /* channel args */, &ctx->pollent, &req,
+      grpc_core::Timestamp::Now() + grpc_jwt_verifier_max_delay,
       GRPC_CLOSURE_CREATE(on_keys_retrieved, ctx, grpc_schedule_on_exec_ctx),
-      &ctx->responses[HTTP_RESPONSE_KEYS]);
-  grpc_resource_quota_unref_internal(resource_quota);
-  gpr_free(req.host);
+      &ctx->responses[HTTP_RESPONSE_KEYS],
+      grpc_core::CreateHttpRequestSSLCredentials());
+  ctx->http_request->Start();
+  gpr_free(host);
   return;
 
 error:
@@ -742,8 +773,8 @@ static void verifier_put_mapping(grpc_jwt_verifier* v, const char* email_domain,
   GPR_ASSERT(v->num_mappings <= v->allocated_mappings);
 }
 
-/* Very non-sophisticated way to detect an email address. Should be good
-   enough for now... */
+// Very non-sophisticated way to detect an email address. Should be good
+// enough for now...
 const char* grpc_jwt_issuer_email_domain(const char* issuer) {
   const char* at_sign = strchr(issuer, '@');
   if (at_sign == nullptr) return nullptr;
@@ -752,24 +783,25 @@ const char* grpc_jwt_issuer_email_domain(const char* issuer) {
   const char* dot = strrchr(email_domain, '.');
   if (dot == nullptr || dot == email_domain) return email_domain;
   GPR_ASSERT(dot > email_domain);
-  /* There may be a subdomain, we just want the domain. */
-  dot = static_cast<const char*>(gpr_memrchr(
-      (void*)email_domain, '.', static_cast<size_t>(dot - email_domain)));
+  // There may be a subdomain, we just want the domain.
+  dot = static_cast<const char*>(
+      gpr_memrchr(email_domain, '.', static_cast<size_t>(dot - email_domain)));
   if (dot == nullptr) return email_domain;
   return dot + 1;
 }
 
-/* Takes ownership of ctx. */
+// Takes ownership of ctx.
 static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
   const char* email_domain;
   grpc_closure* http_cb;
   char* path_prefix = nullptr;
   const char* iss;
-  grpc_httpcli_request req;
-  grpc_resource_quota* resource_quota = nullptr;
-  memset(&req, 0, sizeof(grpc_httpcli_request));
-  req.handshaker = &grpc_httpcli_ssl;
+  grpc_http_request req;
+  memset(&req, 0, sizeof(grpc_http_request));
   http_response_index rsp_idx;
+  char* host;
+  char* path;
+  absl::StatusOr<grpc_core::URI> uri;
 
   GPR_ASSERT(ctx != nullptr && ctx->header != nullptr &&
              ctx->claims != nullptr);
@@ -783,11 +815,11 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
     goto error;
   }
 
-  /* This code relies on:
-     https://openid.net/specs/openid-connect-discovery-1_0.html
-     Nobody seems to implement the account/email/webfinger part 2. of the spec
-     so we will rely instead on email/url mappings if we detect such an issuer.
-     Part 4, on the other hand is implemented by both google and salesforce. */
+  // This code relies on:
+  // https://openid.net/specs/openid-connect-discovery-1_0.html
+  // Nobody seems to implement the account/email/webfinger part 2. of the spec
+  // so we will rely instead on email/url mappings if we detect such an issuer.
+  // Part 4, on the other hand is implemented by both google and salesforce.
   email_domain = grpc_jwt_issuer_email_domain(iss);
   if (email_domain != nullptr) {
     email_key_mapping* mapping;
@@ -797,43 +829,46 @@ static void retrieve_key_and_verify(verifier_cb_ctx* ctx) {
       gpr_log(GPR_ERROR, "Missing mapping for issuer email.");
       goto error;
     }
-    req.host = gpr_strdup(mapping->key_url_prefix);
-    path_prefix = strchr(req.host, '/');
+    host = gpr_strdup(mapping->key_url_prefix);
+    path_prefix = strchr(host, '/');
     if (path_prefix == nullptr) {
-      gpr_asprintf(&req.http.path, "/%s", iss);
+      gpr_asprintf(&path, "/%s", iss);
     } else {
       *(path_prefix++) = '\0';
-      gpr_asprintf(&req.http.path, "/%s/%s", path_prefix, iss);
+      gpr_asprintf(&path, "/%s/%s", path_prefix, iss);
     }
     http_cb =
         GRPC_CLOSURE_CREATE(on_keys_retrieved, ctx, grpc_schedule_on_exec_ctx);
     rsp_idx = HTTP_RESPONSE_KEYS;
   } else {
-    req.host = gpr_strdup(strstr(iss, "https://") == iss ? iss + 8 : iss);
-    path_prefix = strchr(req.host, '/');
+    host = gpr_strdup(strstr(iss, "https://") == iss ? iss + 8 : iss);
+    path_prefix = strchr(host, '/');
     if (path_prefix == nullptr) {
-      req.http.path = gpr_strdup(GRPC_OPENID_CONFIG_URL_SUFFIX);
+      path = gpr_strdup(GRPC_OPENID_CONFIG_URL_SUFFIX);
     } else {
       *(path_prefix++) = 0;
-      gpr_asprintf(&req.http.path, "/%s%s", path_prefix,
-                   GRPC_OPENID_CONFIG_URL_SUFFIX);
+      gpr_asprintf(&path, "/%s%s", path_prefix, GRPC_OPENID_CONFIG_URL_SUFFIX);
     }
     http_cb = GRPC_CLOSURE_CREATE(on_openid_config_retrieved, ctx,
                                   grpc_schedule_on_exec_ctx);
     rsp_idx = HTTP_RESPONSE_OPENID;
   }
 
-  /* TODO(ctiller): Carry the resource_quota in ctx and share it with the host
-     channel. This would allow us to cancel an authentication query when under
-     extreme memory pressure. */
-  resource_quota = grpc_resource_quota_create("jwt_verifier");
-  grpc_httpcli_get(
-      &ctx->verifier->http_ctx, &ctx->pollent, resource_quota, &req,
-      grpc_core::ExecCtx::Get()->Now() + grpc_jwt_verifier_max_delay, http_cb,
-      &ctx->responses[rsp_idx]);
-  grpc_resource_quota_unref_internal(resource_quota);
-  gpr_free(req.host);
-  gpr_free(req.http.path);
+  // TODO(ctiller): Carry the resource_quota in ctx and share it with the host
+  // channel. This would allow us to cancel an authentication query when under
+  // extreme memory pressure.
+  uri = grpc_core::URI::Create("https", host, path, {} /* query params */,
+                               "" /* fragment */);
+  if (!uri.ok()) {
+    goto error;
+  }
+  ctx->http_request = grpc_core::HttpRequest::Get(
+      std::move(*uri), nullptr /* channel args */, &ctx->pollent, &req,
+      grpc_core::Timestamp::Now() + grpc_jwt_verifier_max_delay, http_cb,
+      &ctx->responses[rsp_idx], grpc_core::CreateHttpRequestSSLCredentials());
+  ctx->http_request->Start();
+  gpr_free(host);
+  gpr_free(path);
   return;
 
 error:
@@ -889,17 +924,15 @@ error:
 grpc_jwt_verifier* grpc_jwt_verifier_create(
     const grpc_jwt_verifier_email_domain_key_url_mapping* mappings,
     size_t num_mappings) {
-  grpc_jwt_verifier* v =
-      static_cast<grpc_jwt_verifier*>(gpr_zalloc(sizeof(grpc_jwt_verifier)));
-  grpc_httpcli_context_init(&v->http_ctx);
+  grpc_jwt_verifier* v = grpc_core::Zalloc<grpc_jwt_verifier>();
 
-  /* We know at least of one mapping. */
+  // We know at least of one mapping.
   v->allocated_mappings = 1 + num_mappings;
   v->mappings = static_cast<email_key_mapping*>(
       gpr_malloc(v->allocated_mappings * sizeof(email_key_mapping)));
   verifier_put_mapping(v, GRPC_GOOGLE_SERVICE_ACCOUNTS_EMAIL_DOMAIN,
                        GRPC_GOOGLE_SERVICE_ACCOUNTS_KEY_URL_PREFIX);
-  /* User-Provided mappings. */
+  // User-Provided mappings.
   if (mappings != nullptr) {
     size_t i;
     for (i = 0; i < num_mappings; i++) {
@@ -913,7 +946,6 @@ grpc_jwt_verifier* grpc_jwt_verifier_create(
 void grpc_jwt_verifier_destroy(grpc_jwt_verifier* v) {
   size_t i;
   if (v == nullptr) return;
-  grpc_httpcli_context_destroy(&v->http_ctx);
   if (v->mappings != nullptr) {
     for (i = 0; i < v->num_mappings; i++) {
       gpr_free(v->mappings[i].email_domain);