Question

我正在使用私钥（授权服务器）签署JWT，并且正在使用公钥（资源服务器）对其进行“验证” ... 我怎么知道JWT是否没有受到损害？或者我该怎么做？

代码来自资源服务器

       JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        Resource resource = new ClassPathResource("public.txt");
        String publicKey = null;
        try {
            publicKey = IOUtils.toString(resource.getInputStream());
        } catch (final IOException e) {
            throw new RuntimeException(e);
        }
        converter.setVerifierKey(publicKey);

        return converter;
    }

Answer 1

Spring Security将根据授权服务器中的配置对令牌进行验证。

对于独立验证，代码如下：

  RsaVerifier verifier = new RsaVerifier(RSAPublicKey);
  Jwt tokenDecoded = JwtHelper.decodeAndVerify(token, verifier);
  Map<String, Object> claimsMap = (Map<String, Object>) new 
  ObjectMapper().readValue(tokenDecoded.getClaims(), Map.class);
  //Verify the claims then
  // 1 Verify if the token has not already expired
  // 2 Verify the issuance date ( should be before this date )
  // 3 Verify if the issuer of this token is contained in verified authorities.
  // 4 Verify if the token was issued for this client
  // 5 Verify if the token contained any expected claims...

但是以上内容是由Spring Security用于Oauth2身份验证过程实现的，客户端应用程序只需要提供配置即可。

触发器是Spring安全过滤器链中的OAuth2AuthenticationProcessingFilter。当资源受Oauth2安全性保护时，将添加此过滤器。

在您的应用程序中，授权服务器配置看起来像（下面仅提取了相关的指示性配置）

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

...
 @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        RSAPemKeyPairLoader keyPairLoader = new RSAPemKeyPairLoader();
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setSigningKey(...);
        converter.setVerifierKey(...);
        return converter;
    }

 @Bean
    @Primary
    public DefaultTokenServices tokenServices() {
        DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
        defaultTokenServices.setTokenStore(tokenStore());
        defaultTokenServices.setSupportRefreshToken(...);
        defaultTokenServices.setAccessTokenValiditySeconds(...);
        defaultTokenServices.setRefreshTokenValiditySeconds(...);
        return defaultTokenServices;
    }
}

在您的应用程序中，资源服务器配置如下：

@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
@Override
  public void configure(HttpSecurity http) throws Exception {
   ...
  }
}

要在Spring实施中进行跟踪，在该实施中将拦截并验证请求的令牌，请查看下面的Spring OAUTH2实施-流程详细信息，其中Authentication对象将尝试为成功的请求创建OAuth2Authentication实例。

以下所有代码摘录均来自spring-security-oauth2-2.0.8.RELEASE实现。

public class OAuth2AuthenticationManager implements AuthenticationManager {

                ....
                public Authentication authenticate(Authentication authentication) throws AuthenticationException {

                        if (authentication == null) {
                            throw new InvalidTokenException("Invalid token (token not found)");
                        }
                        String token = (String) authentication.getPrincipal();
                        OAuth2Authentication auth = tokenServices.loadAuthentication(token);
                        ...
         }
}

loadAuthentication将基本上是验证访问令牌，并尝试将其转换为OAuth2Authentication

public class DefaultTokenServices implements AuthorizationServerTokenServices ...{

           public OAuth2Authentication loadAuthentication(String accessTokenValue) throws AuthenticationException, InvalidTokenException {

                   OAuth2AccessToken accessToken = tokenStore.readAccessToken(accessTokenValue);
                    ...
            }
}

JwtTokenStore将创建OAuth2AccessToken并在此过程中解码并验证String令牌。

    public class JwtTokenStore implements TokenStore {

        public OAuth2AccessToken readAccessToken(String tokenValue) {
                OAuth2AccessToken accessToken = convertAccessToken(tokenValue);
                if (jwtTokenEnhancer.isRefreshToken(accessToken)) {
                    throw new InvalidTokenException("Encoded token is a refresh token");
                }
                return accessToken;
            }

        private OAuth2AccessToken convertAccessToken(String tokenValue) {
                return jwtTokenEnhancer.extractAccessToken(tokenValue, jwtTokenEnhancer.decode(tokenValue));
            }

  }

JWTAccessTokenConverter进行令牌声明的解码和提取。

public class JwtAccessTokenConverter implements AccessTokenConverter {

   protected Map<String, Object> decode(String token) {
                    try {
                        Jwt jwt = JwtHelper.decodeAndVerify(token, verifier);
                        String content = jwt.getClaims();
                        Map<String, Object> map = objectMapper.parseMap(content);
                        if (map.containsKey(EXP) && map.get(EXP) instanceof Integer) {
                            Integer intValue = (Integer) map.get(EXP);
                            map.put(EXP, new Long(intValue));
                        }
                        return map;
                    }
                    catch (Exception e) {
                        throw new InvalidTokenException("Cannot convert access token to JSON", e);
                    }
}

JwtHelper将进行解码并请求验证。

public static Jwt decodeAndVerify(String token, SignatureVerifier verifier) {
     Jwt jwt = decode(token);
     jwt.verifySignature(verifier);
     return jwt;
}

JwttImpl调用验证程序。

public void verifySignature(SignatureVerifier verifier) {
    verifier.verify(signingInput(), crypto);
}

例如，RSA Signature验证程序最终将进行验证：

public class RsaVerifier implements SignatureVerifier {

            public void verify(byte[] content, byte[] sig) {
                    try {
                        Signature signature = Signature.getInstance(algorithm);
                        signature.initVerify(key);
                        signature.update(content);

                        if (!signature.verify(sig)) {
                            throw new InvalidSignatureException("RSA Signature did not match content");
                        }
                    }
                    catch (GeneralSecurityException e) {
                        throw new RuntimeException(e);
                    }
                }
    }

验证已签署的JWT

1 个答案: