jwtbutler 1.6.7 → 1.7.0

package/README.md

@@ -4,20 +4,20 @@ jwtbutler is a helper library for setting up a single sign on with jwt in a mult
 
 ## features
 
--   works in all js applications
--   renders a simple loginform if needed
--   requires no code changes on the auth server
--   has a fetch helper function for api calls that do all the heavy lifting (e.g. refreshing token, repeating calls) under the hood
--   provides a fallback for clients that have third party cookies disabled
--   includes a timeout for broken connections
--   syncs cookies via iframes through postmessage
--   works also without single sign on
--   full ie11 support
--   full chrome support (SameSite=None)
+- works in all js applications
+- renders a simple loginform if needed
+- requires no code changes on the auth server
+- has a fetch helper function for api calls that do all the heavy lifting (e.g. refreshing token, repeating calls) under the hood
+- provides a fallback for clients that have third party cookies disabled
+- includes a timeout for broken connections
+- syncs cookies via iframes through postmessage
+- works also without single sign on
+- full ie11 support
+- full chrome support (SameSite=None)
 
 ## requirements
 
--   a fully setup jwt auth server (like [simpleauth](https://github.com/vielhuber/simpleauth)) with the following routes
+- a fully setup jwt auth server (like [simpleauth](https://github.com/vielhuber/simpleauth)) with the following routes
 
 | route    | method | arguments      | header                      | response                                                                                                                                                                |
 | -------- | ------ | -------------- | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -26,7 +26,7 @@ jwtbutler is a helper library for setting up a single sign on with jwt in a mult
 | /logout  | POST   | --             | Authorization: Bearer token | `([ 'success' => true, 'message' => 'logout successful', 'public_message' => '...' ], 200)`                                                                             |
 | /check   | POST   | access_token   | --                          | `([ 'success' => true, 'message' => 'valid token', 'public_message' => '...', 'data' => [ 'expires_in' => 3600, 'user_id' => 42, 'client_id' => 7000000 ] ], 200)`      |
 
--   401 response code on bad authentication
+- 401 response code on bad authentication
 
 ## installation
 
@@ -50,7 +50,7 @@ now instantiate the object with the basic configuration:
 
 ```js
 const api = new jwtbutler({
-    auth_server: 'http://example-auth-server.local.vielhuber.de',
+    auth_server: 'https://example-auth-server.vielhuber.dev',
     auth_login: 'email'
 });
 ```
@@ -61,9 +61,9 @@ if you want to use sso, add all pages to the configuration object:
 
 ```js
 sso: [
-    'http://example-auth-page1.local.vielhuber.de',
-    'http://example-auth-page2.local.vielhuber.de',
-    'http://example-auth-page3.local.vielhuber.de'
+    'https://example-auth-page1.vielhuber.dev',
+    'https://example-auth-page2.vielhuber.dev',
+    'https://example-auth-page3.vielhuber.dev'
 ];
 ```
 
@@ -138,8 +138,8 @@ api.getUserId();
 // if the user is not logged in and a new token cannot be generated,
 // a login form is rendered and after a succesful login, the request is again repeated
 // fetch has the same interface as the official javascript Fetch API
-api.fetch('http://example-auth-page1.local.vielhuber.de/protected/');
-api.fetch('http://example-auth-page2.local.vielhuber.de/protected/', {
+api.fetch('https://example-auth-page1.vielhuber.dev/protected/');
+api.fetch('https://example-auth-page2.vielhuber.dev/protected/', {
     method: 'POST',
     body: JSON.stringify({ foo: 'bar' }),
     cache: 'no-cache',
@@ -161,15 +161,15 @@ api.logout().then(() => {
 
 use the following classes to style idle states:
 
--   `html.jwtbutler-logging-in`
--   `html.jwtbutler-logging-out`
--   `html.jwtbutler-loading` (for logging in and out)
--   `html.jwtbutler-fetching`
--   `html.jwtbutler-login-form-visible`
+- `html.jwtbutler-logging-in`
+- `html.jwtbutler-logging-out`
+- `html.jwtbutler-loading` (for logging in and out)
+- `html.jwtbutler-fetching`
+- `html.jwtbutler-login-form-visible`
 
 to style the login form, use the class of the main container:
 
--   `.login-form`
+- `.login-form`
 
 some basic styling of the login form can look like this:
 
@@ -201,6 +201,7 @@ composer require firebase/php-jwt
 ```php
 require_once __DIR__ . '/vendor/autoload.php';
 use Firebase\JWT\JWT;
+use Firebase\JWT\Key;
 
 // cors
 header('Access-Control-Allow-Origin: *');
@@ -213,8 +214,7 @@ if (@$_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
 try {
     $user_id = JWT::decode(
         str_replace('Bearer ', '', @$_SERVER['HTTP_AUTHORIZATION']), // access token
-        'WM38tprPABEgkldbt2yTAgxf2CGstfr5', // secret key
-        ['HS256']
+        new Key('WM38tprPABEgkldbt2yTAgxf2CGstfr5', 'HS256'), // secret key
     )->sub;
     http_response_code(200);
     echo json_encode([
@@ -248,10 +248,10 @@ RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
 
 setup the following vhosts:
 
--   http://example-auth-server.local.vielhuber.de => jwt auth server
--   http://example-auth-page1.local.vielhuber.de => \_tests/page1
--   http://example-auth-page2.local.vielhuber.de => \_tests/page2
--   http://example-auth-page3.local.vielhuber.de => \_tests/page3
+- https://example-auth-server.vielhuber.dev => jwt auth server (like [simpleauth](https://github.com/vielhuber/simpleauth))
+- https://example-auth-page1.vielhuber.dev => \_tests/page1
+- https://example-auth-page2.vielhuber.dev => \_tests/page2
+- https://example-auth-page3.vielhuber.dev => \_tests/page3
 
 and then run the test:
 
@@ -261,55 +261,55 @@ gulp js-test
 
 ## pseudo code
 
--   if pageX wants to check if user is logged in on client side (without a backend call)
-    -   pageX frontend checks if access_token is present in cookie and can be decoded (the token is not validated and it also can be expired)
-        -   if no, the user is considered to be logged out
-        -   if yes, the user is considered to be logged in
--   if a logged in user makes an backend/api call on pageX
-    -   pageX frontend checks if access_token is present in cookie and can be decoded (the token is not validated and it also can be expired)
-        -   if no, the user is considered to be not logged in
-            -   see login procedure
-            -   the call is repeated automatically after a succesful login
-        -   if yes, the user is considered to be logged in
-            -   the user sets the access_token in the header ("Bearer")
-            -   pageX backend validates the access token with the secret key
-                -   if the validation is ok
-                    -   the backend extracts the user id from the token and uses that to provide data
-                    -   the final response is served to the client
-                -   if the validation is not ok
-                    -   an error is served to the client
-                    -   the client tries to generate a new token from the old one
-                        -   if that was successful
-                            -   pageX sets cookie for oneself
-                            -   if user has enabled third party cookies
-                                -   pageX server sets new access token in cookie via iframes for all other pages
-                            -   the call will be repeated automatically
-                        -   if that was not successful
-                            -   see login procedure
-                            -   the call is repeated automatically after a succesful login
--   login procedure
-    -   pageX frontend verifies the access_token via secret_key via the /check route
-        -   if available and not expired
-            -   pageX sets cookie for oneself
-            -   if user has enabled third party cookies
-                -   pageX server sets new access token in cookie via iframes for all other pages
-        -   if available and expired
-            -   pageX frontend tries to generate a new token from old token via the /refresh route
-                -   if it worked
-                    -   pageX sets cookie for oneself
-                    -   if user has enabled third party cookies
-                        -   pageX server sets new access token in cookie via iframes for all other pages
-                -   if it didn't work
-                    -   render login form
-        -   if not available
-            -   render login form
--   if the user submits the rendered login form on pageX
-    -   pageX gets back access token from auth server
-    -   pageX sets cookie for oneself
-    -   if user has enabled third party cookies
-        -   pageX sets cookie via iframes for all other pages
--   if the user calls the logout function on pageX
-    -   pageX calls auth server to logout (this invalidates the token on the server side)
-    -   pageX removes cookie for oneself
-    -   if user has enabled third party cookies
-        -   pageX removes cookie via iframes for all other pages
+- if pageX wants to check if user is logged in on client side (without a backend call)
+    - pageX frontend checks if access_token is present in cookie and can be decoded (the token is not validated and it also can be expired)
+        - if no, the user is considered to be logged out
+        - if yes, the user is considered to be logged in
+- if a logged in user makes an backend/api call on pageX
+    - pageX frontend checks if access_token is present in cookie and can be decoded (the token is not validated and it also can be expired)
+        - if no, the user is considered to be not logged in
+            - see login procedure
+            - the call is repeated automatically after a succesful login
+        - if yes, the user is considered to be logged in
+            - the user sets the access_token in the header ("Bearer")
+            - pageX backend validates the access token with the secret key
+                - if the validation is ok
+                    - the backend extracts the user id from the token and uses that to provide data
+                    - the final response is served to the client
+                - if the validation is not ok
+                    - an error is served to the client
+                    - the client tries to generate a new token from the old one
+                        - if that was successful
+                            - pageX sets cookie for oneself
+                            - if user has enabled third party cookies
+                                - pageX server sets new access token in cookie via iframes for all other pages
+                            - the call will be repeated automatically
+                        - if that was not successful
+                            - see login procedure
+                            - the call is repeated automatically after a succesful login
+- login procedure
+    - pageX frontend verifies the access_token via secret_key via the /check route
+        - if available and not expired
+            - pageX sets cookie for oneself
+            - if user has enabled third party cookies
+                - pageX server sets new access token in cookie via iframes for all other pages
+        - if available and expired
+            - pageX frontend tries to generate a new token from old token via the /refresh route
+                - if it worked
+                    - pageX sets cookie for oneself
+                    - if user has enabled third party cookies
+                        - pageX server sets new access token in cookie via iframes for all other pages
+                - if it didn't work
+                    - render login form
+        - if not available
+            - render login form
+- if the user submits the rendered login form on pageX
+    - pageX gets back access token from auth server
+    - pageX sets cookie for oneself
+    - if user has enabled third party cookies
+        - pageX sets cookie via iframes for all other pages
+- if the user calls the logout function on pageX
+    - pageX calls auth server to logout (this invalidates the token on the server side)
+    - pageX removes cookie for oneself
+    - if user has enabled third party cookies
+        - pageX removes cookie via iframes for all other pages

package/_js/_build/_helpers.js

@@ -1,80 +1,43 @@
 "use strict";
 
-var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
-
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.default = void 0;
-
-require("core-js/modules/es.regexp.exec.js");
-
-require("core-js/modules/es.string.match.js");
-
 require("core-js/modules/es.regexp.constructor.js");
-
-require("core-js/modules/es.regexp.to-string.js");
-
-var _classCallCheck2 = _interopRequireDefault(require("@babel/runtime/helpers/classCallCheck"));
-
-var _createClass2 = _interopRequireDefault(require("@babel/runtime/helpers/createClass"));
-
-var helpers = /*#__PURE__*/function () {
-  function helpers() {
-    (0, _classCallCheck2.default)(this, helpers);
-  }
-
-  (0, _createClass2.default)(helpers, null, [{
-    key: "cookieExists",
-    value: function cookieExists(cookie_name) {
-      if (document.cookie !== undefined && this.cookieGet(cookie_name) !== null) {
-        return true;
-      }
-
-      return false;
+require("core-js/modules/es.regexp.exec.js");
+class helpers {
+  static cookieExists(cookie_name) {
+    if (document.cookie !== undefined && this.cookieGet(cookie_name) !== null) {
+      return true;
     }
-  }, {
-    key: "cookieGet",
-    value: function cookieGet(cookie_name) {
-      var cookie_match = document.cookie.match(new RegExp(cookie_name + '=([^;]+)'));
-
-      if (cookie_match) {
-        return decodeURIComponent(cookie_match[1]);
-      }
-
-      return null;
+    return false;
+  }
+  static cookieGet(cookie_name) {
+    var cookie_match = document.cookie.match(new RegExp(cookie_name + '=([^;]+)'));
+    if (cookie_match) {
+      return decodeURIComponent(cookie_match[1]);
     }
-  }, {
-    key: "cookieSet",
-    value: function cookieSet(cookie_name, cookie_value, days) {
-      var samesite = '';
-
-      if (window.location.protocol.indexOf('https') > -1) {
-        samesite = '; SameSite=None; Secure';
-      }
-
-      document.cookie = cookie_name + '=' + encodeURIComponent(cookie_value) + '; ' + 'expires=' + new Date(new Date().getTime() + days * 24 * 60 * 60 * 1000).toUTCString() + '; path=/' + samesite;
+    return null;
+  }
+  static cookieSet(cookie_name, cookie_value, days) {
+    let samesite = '';
+    if (window.location.protocol.indexOf('https') > -1) {
+      samesite = '; SameSite=None; Secure';
     }
-  }, {
-    key: "cookieDelete",
-    value: function cookieDelete(cookie_name) {
-      var samesite = '';
-
-      if (window.location.protocol.indexOf('https') > -1) {
-        samesite = '; SameSite=None; Secure';
-      }
-
-      document.cookie = cookie_name + '=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/' + samesite;
+    document.cookie = cookie_name + '=' + encodeURIComponent(cookie_value) + '; ' + 'expires=' + new Date(new Date().getTime() + days * 24 * 60 * 60 * 1000).toUTCString() + '; path=/' + samesite;
+  }
+  static cookieDelete(cookie_name) {
+    let samesite = '';
+    if (window.location.protocol.indexOf('https') > -1) {
+      samesite = '; SameSite=None; Secure';
     }
-  }, {
-    key: "remove",
-    value: function remove(el) {
-      if (el !== null) {
-        el.parentNode.removeChild(el);
-      }
+    document.cookie = cookie_name + '=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/' + samesite;
+  }
+  static remove(el) {
+    if (el !== null) {
+      el.parentNode.removeChild(el);
     }
-  }]);
-  return helpers;
-}();
-
+  }
+}
 exports.default = helpers;