rack-cloudflare-jwt 0.0.6 → 0.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b02234c4f02891933a6509fafc629a63caa158f3272881a3342965f4da300511
-  data.tar.gz: 6d6746b102725c8f48818158d99fc631af3a4420ccdb2ef8cb52adbd1dc7319d
+  metadata.gz: 7c4ed6badeecd1b367985b571e0c2d308b1ec1f738f228c1d818ea1d17ef4f05
+  data.tar.gz: ac39d8ec47898b8069e538a1b1593faea1f5e8b0f7823a9e8eb75ea7d7add310
 SHA512:
-  metadata.gz: 5ea641bd7ea94915e07dfc19d82a1b173872a2b2b09eb6dcefabe2229d09d445caa4c9553f85c359615850cd03849820b09d8ca37ad72a75bc2af897bb4fcb19
-  data.tar.gz: 2936ec4b34f29bfa86b39cf4fb0360729e4a92706ffb7c7bf730f1b49c0dfc132f24f29335f42e7275c838bfd8674e819a572d6fe430682e89601f290184118d
+  metadata.gz: 24184df0dd0e17acc8e6cad290a7b34e40146865c9a377475d135e0ad7046f7b6bea682418a9602e08be89964902ab4cd680be8d49f853b38ef6e3920ad09cee
+  data.tar.gz: 196a5aa4ab5ea4370d21a90080493025dc3530cda35b027bdb24a2844ae0dfa3d9f117dc137e011ec65ee0ebc9d3875394286328b708aca2a9c9007ddd88ae4d

data/lib/rack/cloudflare_jwt/auth.rb

@@ -11,12 +11,17 @@ module Rack
     #
     # @see https://developers.cloudflare.com/access/setting-up-access/validate-jwt-tokens/
     class Auth
+      # Custom decode token error.
+      class DecodeTokenError < StandardError; end
+
       # Certs path
       CERTS_PATH = '/cdn-cgi/access/certs'
       # Default algorithm
       DEFAULT_ALGORITHM = 'RS256'
       # CloudFlare JWT header.
       HEADER_NAME = 'HTTP_CF_ACCESS_JWT_ASSERTION'
+      # HTTP_HOST header.
+      HEADER_HTTP_HOST = 'HTTP_HOST'
 
       # Token regex.
       #
@@ -79,12 +84,14 @@ module Rack
         # extract the token from header.
         token         = env[HEADER_NAME]
         decoded_token = public_keys(env).find do |key|
-          dt = decode_token(token, key.public_key)
-          break dt if dt
+          break decode_token(token, key.public_key)
+        rescue DecodeTokenError => e
+          logger.info e.message
+          nil
         end
 
         if decoded_token
-          Rails.logger.debug 'CloudFlare JWT token is valid'
+          logger.debug 'CloudFlare JWT token is valid'
 
           env['jwt.payload'] = decoded_token.first
           env['jwt.header']  = decoded_token.last
@@ -103,30 +110,32 @@ module Rack
       #     {"alg"=>"RS256"} # header
       #   ]
       #
-      # @return [Array<Hash>] the token.
+      # @return [Array<Hash>] the token or `nil` at error.
+      # @raise [DecodeTokenError] if the token is invalid.
+      #
       # @see https://github.com/jwt/ruby-jwt/tree/v2.2.1#algorithms-and-usage
       def decode_token(token, secret)
         Rack::JWT::Token.decode(token, secret, true, aud: policy_aud, verify_aud: true, algorithm: DEFAULT_ALGORITHM)
       rescue ::JWT::VerificationError
-        Rails.logger.info 'Invalid JWT token : Signature Verification Error'
+        raise DecodeTokenError, 'Invalid JWT token : Signature Verification Error'
       rescue ::JWT::ExpiredSignature
-        Rails.logger.info 'Invalid JWT token : Expired Signature (exp)'
+        raise DecodeTokenError, 'Invalid JWT token : Expired Signature (exp)'
       rescue ::JWT::IncorrectAlgorithm
-        Rails.logger.info 'Invalid JWT token : Incorrect Key Algorithm'
+        raise DecodeTokenError, 'Invalid JWT token : Incorrect Key Algorithm'
       rescue ::JWT::ImmatureSignature
-        Rails.logger.info 'Invalid JWT token : Immature Signature (nbf)'
+        raise DecodeTokenError, 'Invalid JWT token : Immature Signature (nbf)'
       rescue ::JWT::InvalidIssuerError
-        Rails.logger.info 'Invalid JWT token : Invalid Issuer (iss)'
+        raise DecodeTokenError, 'Invalid JWT token : Invalid Issuer (iss)'
       rescue ::JWT::InvalidIatError
-        Rails.logger.info 'Invalid JWT token : Invalid Issued At (iat)'
+        raise DecodeTokenError, 'Invalid JWT token : Invalid Issued At (iat)'
       rescue ::JWT::InvalidAudError
-        Rails.logger.info 'Invalid JWT token : Invalid Audience (aud)'
+        raise DecodeTokenError, 'Invalid JWT token : Invalid Audience (aud)'
       rescue ::JWT::InvalidSubError
-        Rails.logger.info 'Invalid JWT token : Invalid Subject (sub)'
+        raise DecodeTokenError, 'Invalid JWT token : Invalid Subject (sub)'
       rescue ::JWT::InvalidJtiError
-        Rails.logger.info 'Invalid JWT token : Invalid JWT ID (jti)'
+        raise DecodeTokenError, 'Invalid JWT token : Invalid JWT ID (jti)'
       rescue ::JWT::DecodeError
-        Rails.logger.info 'Invalid JWT token : Decode Error'
+        raise DecodeTokenError, 'Invalid JWT token : Decode Error'
       end
 
       # Private: Check if current path is in the include_paths.
@@ -162,8 +171,8 @@ module Rack
       #
       # @return [Array<OpenSSL::PKey::RSA>] the public keys.
       def public_keys(env)
-        host = env['HTTP_HOST']
-        keys = Rails.cache.fetch([self.class.name, '#secrets', host]) { fetch_public_keys(host) }
+        host = env[HEADER_HTTP_HOST]
+        keys = cache.fetch([self.class.name, '#secrets', host]) { fetch_public_keys(host) }
         keys.map do |jwk_data|
           ::JWT::JWK.import(jwk_data).keypair
         end
@@ -176,10 +185,24 @@ module Rack
       # @return [Array<Hash>] the public keys.
       def fetch_public_keys(host)
         json = Net::HTTP.get(host, CERTS_PATH)
-        json.present? ? MultiJson.load(json, symbolize_keys: true).fetch(:keys) : []
+        json.empty? ? [] : MultiJson.load(json, symbolize_keys: true).fetch(:keys)
       rescue StandardError
         []
       end
+
+      # Private: Get a cache store.
+      #
+      # @return [ActiveSupport::Cache::Store] the cache store.
+      def cache
+        Rails.cache
+      end
+
+      # Private: Get a logger.
+      #
+      # @return [ActiveSupport::Logger] the logger.
+      def logger
+        Rails.logger
+      end
     end
   end
 end

data/lib/rack/cloudflare_jwt/version.rb

@@ -2,6 +2,6 @@
 
 module Rack
   module CloudflareJwt
-    VERSION = '0.0.6'
+    VERSION = '0.0.7'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-cloudflare-jwt
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.7
 platform: ruby
 authors:
 - Aleksei Vokhmin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-28 00:00:00.000000000 Z
+date: 2020-02-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -94,6 +94,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.16.0
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.8.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.8.0
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement