Skip to content

Commit 27243e4

Browse files
authored
Fix auth validation (#250)
* Fix auth validation
1 parent 67f4d57 commit 27243e4

File tree

2 files changed

+18
-11
lines changed

2 files changed

+18
-11
lines changed

services/identity/src/main/java/com/crapi/config/JwtAuthTokenFilter.java

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,9 @@ protected void doFilterInternal(
7676
response.sendError(
7777
HttpServletResponse.SC_UNAUTHORIZED, UserMessage.ACCOUNT_LOCKED_MESSAGE);
7878
}
79+
} else {
80+
tokenLogger.error(UserMessage.INVALID_CREDENTIALS);
81+
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, UserMessage.INVALID_CREDENTIALS);
7982
}
8083
} catch (Exception e) {
8184
tokenLogger.error("Can NOT set user authentication -> Message:%d", e);
@@ -122,10 +125,13 @@ public String getUserFromToken(HttpServletRequest request) throws ParseException
122125
String username = null;
123126
if (token != null) {
124127
if (apiType == ApiType.APIKEY) {
128+
logger.debug("Token is api token");
125129
username = tokenProvider.getUserNameFromApiToken(token);
126130
} else {
127-
tokenProvider.validateJwtToken(token);
128-
username = tokenProvider.getUserNameFromJwtToken(token);
131+
logger.debug("Token is jwt token");
132+
if (tokenProvider.validateJwtToken(token)) {
133+
username = tokenProvider.getUserNameFromJwtToken(token);
134+
}
129135
}
130136
// checking username from token
131137
if (username != null) return username;

services/identity/src/main/java/com/crapi/config/JwtProvider.java

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -175,25 +175,26 @@ public boolean validateJwtToken(String authToken) {
175175
SignedJWT signedJWT = SignedJWT.parse(authToken);
176176
JWSHeader header = signedJWT.getHeader();
177177
Algorithm alg = header.getAlgorithm();
178-
178+
boolean valid = false;
179179
// JWT Algorithm confusion vulnerability
180-
logger.info("Algorithm: " + alg.getName());
180+
logger.debug("Algorithm: " + alg.getName());
181+
JWSVerifier verifier;
181182
if (Objects.equals(alg.getName(), "HS256")) {
182183
String secret = getJwtSecret(header);
183-
logger.info("JWT Secret: " + secret);
184-
JWSVerifier verifier = new MACVerifier(secret.getBytes(StandardCharsets.UTF_8));
185-
return signedJWT.verify(verifier);
184+
logger.debug("JWT Secret: " + secret);
185+
verifier = new MACVerifier(secret.getBytes(StandardCharsets.UTF_8));
186186
} else {
187187
RSAKey verificationKey = getKeyFromJkuHeader(header);
188-
JWSVerifier verifier;
189188
if (verificationKey == null) {
189+
logger.debug("Key from JWKS: " + this.publicRSAKey.toJSONString());
190190
verifier = new RSASSAVerifier(this.publicRSAKey);
191191
} else {
192-
logger.info("Key from JKU: " + verificationKey.toJSONString());
192+
logger.debug("Key from JKU: " + verificationKey.toJSONString());
193193
verifier = new RSASSAVerifier(verificationKey);
194194
}
195-
196-
return signedJWT.verify(verifier);
195+
valid = signedJWT.verify(verifier);
196+
logger.info("JWT valid?: " + valid);
197+
return valid;
197198
}
198199

199200
} catch (ParseException e) {

0 commit comments

Comments
 (0)