Question

尽管我的JWT令牌为我提供了正确的有效载荷，但我仍然无法通过验证。

如果我对代码的这一部分不太安全，请原谅，因为这是我们的老师通过模板分发的，但是我们无法联系到他。

我们必须对代码本身进行一些更改，因为它已将用户名放入令牌中，并且我们希望放入电子邮件。

我们正在使用一种称为UserPrincipal的东西，据我所知，它用于确定对文件或对象的访问权限，并且最初我们使用角色来确定哪些用户有权访问哪些端点。在本项目中并非如此，因为它是基于其他功能的简短演示。

我们的用户主体类看起来如何？

package rest;

import entity.User;

import java.security.Principal;

public class UserPrincipal implements Principal {

    private String name;
    private String email;

    public UserPrincipal(User user) {
        this.email = user.getEmail();
    }

    public UserPrincipal(String email) {
        super();
        this.email = email;
    }

    @Override
    public String getName() {
        return email;
    }

}

请参阅，这里的用户主体还用来获取角色列表，而不是电子邮件，而是用户名。

我们在哪里使用此用户主体？好吧，我们在生成令牌时会使用它。这也是我们的端点，是的，应该将其移至接口类。

package rest;

import com.google.gson.Gson;
import com.google.gson.JsonObject;
import com.google.gson.JsonParser;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.JWSSigner;
import com.nimbusds.jose.crypto.MACSigner;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
import entity.User;
import facade.UserFacade;
import exceptions.AuthenticationException;
import exceptions.GenericExceptionMapper;
import utils.PuSelector;

import javax.ws.rs.Consumes;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import java.util.Date;
import java.util.logging.Level;
import java.util.logging.Logger;

@Path("login")
public class LoginEndpoint {

    private static final int TOKEN_EXPIRE_TIME = 1000 * 60 * 30; // ms * sec * min = 30 min
    private static final UserFacade USER_FACADE = UserFacade.getInstance(PuSelector.getEntityManagerFactory("pu"));

    @POST
    @Consumes(MediaType.APPLICATION_JSON)
    @Produces(MediaType.APPLICATION_JSON)
    public Response login(String jsonString) throws AuthenticationException {

        JsonObject json = new JsonParser().parse(jsonString).getAsJsonObject();
        String email = json.get("email").getAsString();
        String password = json.get("password").getAsString();
        String ip = json.get("ip").getAsString();

        try {
            User user = USER_FACADE.getVeryfiedUser(email, password, ip);
            String code = USER_FACADE.sendCode(email);
            String token = createToken(email);

            JsonObject responseJson = new JsonObject();
            responseJson.addProperty("code", code);
            responseJson.addProperty("email", email);
            responseJson.addProperty("token", token);
            return Response.ok(new Gson().toJson(responseJson)).build();
        } catch (JOSEException | AuthenticationException ex) {
            if (ex instanceof AuthenticationException) {
                throw (AuthenticationException) ex;
            }
            Logger.getLogger(GenericExceptionMapper.class.getName()).log(Level.SEVERE, null, ex);
        }
        throw new AuthenticationException("Somthing went wrong! Please try again");
    }

    private String createToken(String email) throws JOSEException {
        //String firstNameLetter = user.getFirstName().substring(0, 1);
        //String lastNameLetter = user.getLastName().substring(0, 1);
        //int ageTimesID = user.getAge() * user.getId();
        //String name = firstNameLetter + lastNameLetter + ageTimesID;

        String issuer = "the_turtle_troopers";

        JWSSigner signer = new MACSigner(SharedSecret.getSharedKey());
        Date date = new Date();
        JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
                .subject(email)
                .claim("email", email)
                .claim("allowed", true)
                .claim("issuer", issuer)
                .issueTime(date)
                .expirationTime(new Date(date.getTime() + TOKEN_EXPIRE_TIME))
                .build();
        SignedJWT signedJWT = new SignedJWT(new JWSHeader(JWSAlgorithm.HS256), claimsSet);
        signedJWT.sign(signer);
        return signedJWT.serialize();
    }
}

我们有一个安全上下文类。.不确定是否对我的问题有影响，但是不管：

package rest;

import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.core.SecurityContext;
import java.security.Principal;

public class JWTSecurityContext implements SecurityContext {

    UserPrincipal user;
    ContainerRequestContext request;

    public JWTSecurityContext(UserPrincipal user, ContainerRequestContext request) {
        this.user = user;
        this.request = request;
    }

    @Override
    public boolean isUserInRole(String role) {
        return true;
    }

    @Override
    public boolean isSecure() {
        return request.getUriInfo().getBaseUri().getScheme().equals("https");
    }

    @Override
    public Principal getUserPrincipal() {
        return user;
    }

    @Override
    public String getAuthenticationScheme() {
        return "JWT"; //Only for INFO
    }
}

最后，我们有了我们的JWTAuthenticationFilter：

package rest;

import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSVerifier;
import com.nimbusds.jose.crypto.MACVerifier;
import com.nimbusds.jwt.SignedJWT;
import exceptions.AuthenticationException;

import javax.annotation.Priority;
import javax.annotation.security.DenyAll;
import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import javax.ws.rs.Priorities;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerRequestFilter;
import javax.ws.rs.container.ResourceInfo;
import javax.ws.rs.core.Context;
import javax.ws.rs.ext.Provider;
import java.io.IOException;
import java.lang.annotation.Annotation;
import java.text.ParseException;
import java.util.Arrays;
import java.util.Date;
import java.util.List;
import java.util.logging.Level;
import java.util.logging.Logger;

@Provider
@Priority(Priorities.AUTHENTICATION)
public class JWTAuthenticationFilter implements ContainerRequestFilter {

    private static final List<Class<? extends Annotation>> securityAnnotations 
            = Arrays.asList(DenyAll.class, PermitAll.class, RolesAllowed.class);
    @Context
    private ResourceInfo resourceInfo;

    @Override
    public void filter(ContainerRequestContext request) throws IOException {
        if (isSecuredResource()) {

            String token = request.getHeaderString("x-access-token");//
            if (token == null) {
                request.abortWith(exceptions.GenericExceptionMapper.makeErrRes(token, 403));
                return;
            }
            try {
                UserPrincipal user = getUserPrincipalFromTokenIfValid(token);
                //What if the client had logged out????
                request.setSecurityContext(new JWTSecurityContext(user, request));
            } catch (AuthenticationException | ParseException | JOSEException ex) {
                Logger.getLogger(JWTAuthenticationFilter.class.getName()).log(Level.SEVERE, null, ex);
                request.abortWith(exceptions.GenericExceptionMapper.makeErrRes("Token not valid (timed out?)", 403));
            }
        }
    }

    private boolean isSecuredResource() {
        for (Class<? extends Annotation> securityClass : securityAnnotations) {
            if (resourceInfo.getResourceMethod().isAnnotationPresent(securityClass)) {
                return true;
            }
        }
        for (Class<? extends Annotation> securityClass : securityAnnotations) {
            if (resourceInfo.getResourceClass().isAnnotationPresent(securityClass)) {
                return true;
            }
        }
        return false;
    }

    private UserPrincipal getUserPrincipalFromTokenIfValid(String token) throws ParseException, JOSEException, AuthenticationException {
        SignedJWT signedJWT = SignedJWT.parse(token);
        //Is it a valid token (generated with our shared key)
        JWSVerifier verifier = new MACVerifier(SharedSecret.getSharedKey());

        if (signedJWT.verify(verifier)) {
            if (new Date().getTime() > signedJWT.getJWTClaimsSet().getExpirationTime().getTime()) {
                throw new AuthenticationException("Your Token is no longer valid");
            }
            String email = signedJWT.getJWTClaimsSet().getClaim("email").toString();

            return new UserPrincipal(email);
        } else {
            throw new JOSEException("User could not be extracted from token");
        }
    }
}

希望有人能够告诉我为什么我的令牌没有在jwt.io上得到验证

Java-JWT令牌无效签名

0 个答案: