warden-jwt_auth 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1f24397de1422507d524eba4a8c60050e6a6abde
-  data.tar.gz: b767bf87c6b29a12da5a64b4367f619b8685568e
+  metadata.gz: 48b37f5ba1a7935103634d140ab0c1fbbaea54f3
+  data.tar.gz: 853f242af0f389a92a4f20c66800ed5447708830
 SHA512:
-  metadata.gz: 29f2e7ef4ea4de94a68b4cac0e394df30609fa706c6afb468d725000995a68c80227abd64392367b94fda770fe7884aac11041ecd742661d96eaa8045efb04c7
-  data.tar.gz: ab4e91316b5ca085c1f2f1f267656097d788a2e1e5ad1cf9face21402f569aa989264c57bdb8310512d7028a0e10351697abf13ece06512c0470f9bf72b49f93
+  metadata.gz: d15c993a973fade506472bd525a886e2be2a2b5b03ca99223711254c3876739e94704b6f8bdd64a7c01832b5d8f96978768f18638b972be1db4027e2c24bde4d
+  data.tar.gz: ffc3fe32c2dd1cc8d4206d031bb57612615a61219f3daa136c3865dca8445bc437da056760299b0ce5988ce15e74155445936385fefce9e3a215a4ef0426c751

data/CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/) 
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [0.3.0] - 2017-12-06
+### Added
+- Add and call hook method `on_jwt_dispatch` on user instance
+- Encode and validate an `aud` claim from the request headers
+
 ## [0.2.1] - 2017-12-04
 ### Added
 - Allow configuring classes as strings

data/README.md

@@ -24,7 +24,7 @@ If what you need is a JWT authentication library for [devise](https://github.com
 ## Installation
 
 ```ruby
-gem 'warden-jwt_auth', '~> 0.2.1'
+gem 'warden-jwt_auth', '~> 0.3.0'
 ```
 
 And then execute:
@@ -100,6 +100,13 @@ def jwt_payload
 end
 ```
 
+Just when a token is going to be dispatched to a client, a hook method `on_jwt_dispatch` is invoked, only when it exist, on the user record. This method takes the `token` and the `payload` as arguments.
+
+```ruby
+def on_jwt_dispatch(token, payload)
+  # Do something
+end
+
 ### Middlewares addition
 
 You need to add `Warden::JWTAuth::Middleware` to your rack middlewares stack. Actually, it is just a wrapper which adds two middlewares that do the actual job: dispatching tokens and revoking tokens.
@@ -164,6 +171,12 @@ module RevocationStrategy
 end
 ```
 
+### Requesting client validation
+
+Authentication will be refused if a client requesting to be authenticated through a token is not the same to which it was originally issued. To do so, the content of the header `JWT_AUD` (configurable via `config.aud_header`) is stored as `aud` claim. If you don't want to differentiate between clients, you don't need to provide that header.
+
+**Important:** Be aware that this workflow is not bullet proof. In some scenarios a user can handcraft the request headers, therefore being able to impersonate any client. In such cases you could need something more robust, like an OAuth workflow with client id and client secret.
+
 ## Development
 
 There are docker and docker-compose files configured to create a development environment for this gem. So, if you use Docker you only need to run:

data/lib/warden/jwt_auth.rb

@@ -25,6 +25,12 @@ module Warden
     # Expiration time for tokens
     setting :expiration_time, 3600
 
+    # Request header which value will be encoded as `aud` claim in JWT. If
+    # the header is not present `aud` will be `nil`.
+    setting(:aud_header, 'JWT_AUD') do |value|
+      ('HTTP_' + value.upcase).tr('-', '_')
+    end
+
     # A hash of warden scopes as keys and user repositories as values. The
     # values can be either the constants themselves or the constant names.
     #

data/lib/warden/jwt_auth/env_helper.rb

@@ -47,6 +47,14 @@ module Warden
         env['HTTP_AUTHORIZATION'] = value
         env
       end
+
+      # Returns header configured through `aud_header` option
+      #
+      # @param env [Hash] Rack env
+      # @return [String]
+      def self.aud_header(env)
+        env[JWTAuth.config.aud_header]
+      end
     end
   end
 end

data/lib/warden/jwt_auth/errors.rb

@@ -16,6 +16,11 @@ module Warden
       # match the one encoded in the payload
       class WrongScope < JWT::DecodeError
       end
+
+      # Error raised when trying to decode a token which `aud` claim does not
+      # match with the expected one
+      class WrongAud < JWT::DecodeError
+      end
     end
   end
 end

data/lib/warden/jwt_auth/hooks.rb

@@ -4,7 +4,7 @@ module Warden
   module JWTAuth
     # Warden hooks
     class Hooks
-      include JWTAuth::Import['mappings', 'dispatch_requests']
+      include JWTAuth::Import['mappings', 'dispatch_requests', 'aud_header']
 
       # `env` key where JWT is added
       PREPARED_TOKEN_ENV_KEY = 'warden-jwt_auth.token'
@@ -24,8 +24,7 @@ module Warden
         env = auth.env
         scope = opts[:scope]
         return unless token_should_be_added?(scope, env)
-        token = UserEncoder.new.call(user, scope)
-        env[PREPARED_TOKEN_ENV_KEY] = token
+        add_token_to_env(user, scope, env)
       end
 
       def token_should_be_added?(scope, env)
@@ -34,6 +33,14 @@ module Warden
         jwt_scope?(scope) && request_matches?(path_info, method)
       end
 
+      # :reek:ManualDispatch
+      # :reek:FeatureEnvy
+      def add_token_to_env(user, scope, env)
+        token, payload = UserEncoder.new.call(user, scope, env[aud_header])
+        user.on_jwt_dispatch(token, payload) if user.respond_to?(:on_jwt_dispatch)
+        env[PREPARED_TOKEN_ENV_KEY] = token
+      end
+
       def jwt_scope?(scope)
         jwt_scopes = mappings.keys
         jwt_scopes.include?(scope)

data/lib/warden/jwt_auth/interfaces.rb

@@ -31,6 +31,14 @@ module Warden
         def jwt_payload
           {}
         end
+
+        # Does something just after a JWT for the user has been dispatched.
+        #
+        # @param _token [String]
+        # @param _payload [Hash]
+        def on_jwt_dispatch(_token, _payload)
+          raise NotImplementedError
+        end
       end
 
       # Strategy to manage JWT revocation

data/lib/warden/jwt_auth/payload_user_helper.rb

@@ -22,6 +22,13 @@ module Warden
         payload['scp'] == scope.to_s
       end
 
+      # Returns whether given aud matches with the one encoded in the payload
+      # @param payload [Hash] JWT payload
+      # @return [Boolean]
+      def self.aud_matches?(payload, aud)
+        payload['aud'] == aud
+      end
+
       # Returns the payload to encode for a given user in a scope
       #
       # @param user [Interfaces::User] an user, whatever it is

data/lib/warden/jwt_auth/strategy.rb

@@ -18,7 +18,8 @@ module Warden
       end
 
       def authenticate!
-        user = UserDecoder.new.call(token, scope)
+        aud = EnvHelper.aud_header(env)
+        user = UserDecoder.new.call(token, scope, aud)
         success!(user)
       rescue JWT::DecodeError => exception
         fail!(exception.message)

data/lib/warden/jwt_auth/user_decoder.rb

@@ -21,15 +21,17 @@ module Warden
       #
       # @param token [String] a JWT
       # @param scope [Symbol] Warden scope
+      # @param aud [String] Expected aud claim
       # @return [Interfaces::User] an user, whatever it is
       # @raise [Errors::RevokedToken] when token has been revoked for the
       # encoded user
       # @raise [Errors::NilUser] when decoded user is nil
       # @raise [Errors::WrongScope] when encoded scope does not match with scope
+      # @raise [Errors::WrongAud] when encoded aud does not match with aud
       # argument
-      def call(token, scope)
+      def call(token, scope, aud)
         payload = TokenDecoder.new.call(token)
-        raise Errors::WrongScope, 'wrong scope' unless helper.scope_matches?(payload, scope)
+        check_valid_claims(payload, scope, aud)
         user = helper.find_user(payload)
         check_valid_user(payload, user, scope)
         user
@@ -37,14 +39,15 @@ module Warden
 
       private
 
-      def revoked?(payload, user, scope)
-        strategy = revocation_strategies[scope]
-        strategy.jwt_revoked?(payload, user)
+      def check_valid_claims(payload, scope, aud)
+        raise Errors::WrongScope, 'wrong scope' unless helper.scope_matches?(payload, scope)
+        raise Errors::WrongAud, 'wrong aud' unless helper.aud_matches?(payload, aud)
       end
 
       def check_valid_user(payload, user, scope)
         raise Errors::NilUser, 'nil user' unless user
-        raise Errors::RevokedToken, 'revoked token' if revoked?(payload, user, scope)
+        strategy = revocation_strategies[scope]
+        raise Errors::RevokedToken, 'revoked token' if strategy.jwt_revoked?(payload, user)
       end
     end
   end

data/lib/warden/jwt_auth/user_encoder.rb

@@ -12,17 +12,26 @@ module Warden
         @helper = PayloadUserHelper
       end
 
-      # Encodes a user for given scope into a JWT. Payload generated includes a
-      # `sub` claim which is build calling `jwt_subject` in `user`, and a custom
-      # `scp` claim which value is `scope` as a string. The result of
-      # calling `jwt_payload` in user is also merged into the payload.
+      # Encodes a user for given scope into a JWT.
+      #
+      # Payload generated includes:
+      #
+      # - a `sub` claim which is build calling `jwt_subject` in `user`
+      # - an `aud` claim taken as it is in the `aud` parameter
+      # - a custom `scp` claim taken as the value of the `scope` parameter
+      # as a string.
+      #
+      # The result of calling `jwt_payload` in user is also merged
+      # into the payload.
       #
       # @param user [Interfaces::User] an user, whatever it is
       # @param scope [Symbol] Warden scope
-      # @return [String] encoded JWT
-      def call(user, scope)
-        payload = helper.payload_for_user(user, scope)
-        TokenEncoder.new.call(payload)
+      # @param aud [String] JWT aud claim
+      # @return [String, String] encoded JWT and decoded payload
+      def call(user, scope, aud)
+        payload = helper.payload_for_user(user, scope).merge('aud' => aud)
+        token = TokenEncoder.new.call(payload)
+        [token, payload]
       end
     end
   end

data/lib/warden/jwt_auth/version.rb

@@ -2,6 +2,6 @@
 
 module Warden
   module JWTAuth
-    VERSION = '0.2.1'
+    VERSION = '0.3.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: warden-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Marc Busqué
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-12-04 00:00:00.000000000 Z
+date: 2017-12-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-configurable