@@ -290,40 +290,59 @@ static char *merge_extract_var_claims(ngx_conf_t *cf, ngx_command_t *cmd, void *
290290 {
291291 // add this claim's name to the config struct
292292 ngx_str_t * element = ngx_array_push (claims );
293+
293294 * element = values [i ];
294295
295296 // add an http variable for this claim
296297 size_t var_name_len = 10 + element -> len ;
297298 u_char * buf = ngx_palloc (cf -> pool , sizeof (u_char ) * var_name_len );
299+
298300 if (buf == NULL )
299301 {
300302 return NGX_CONF_ERROR ;
301303 }
302- ngx_sprintf (buf , "jwt_claim_%V" , element );
303- ngx_str_t * var_name = ngx_palloc (cf -> pool , sizeof (ngx_str_t ));
304- if (var_name == NULL )
305- {
306- return NGX_CONF_ERROR ;
307- }
308- var_name -> data = buf ;
309- var_name -> len = var_name_len ;
310- // NGX_HTTP_VAR_CHANGEABLE simplifies the required logic by assuming a JWT claim will always be the same for a given request
311- ngx_http_variable_t * http_var = ngx_http_add_variable (cf , var_name , NGX_HTTP_VAR_CHANGEABLE );
312- if (http_var == NULL )
304+ else
313305 {
314- ngx_log_error (NGX_LOG_ERR , cf -> log , 0 , "failed to add variable %V" , var_name );
315- return NGX_CONF_ERROR ;
316- }
317-
318- http_var -> get_handler = get_jwt_var_claim ;
319-
320- // store the index of this new claim in the claims array as the "data" that will be passed to the getter
321- ngx_uint_t * claim_idx = ngx_palloc (cf -> pool , sizeof (ngx_uint_t ));
322- if (claim_idx == NULL ) {
306+ ngx_sprintf (buf , "jwt_claim_%V" , element );
307+ ngx_str_t * var_name = ngx_palloc (cf -> pool , sizeof (ngx_str_t ));
308+
309+ if (var_name == NULL )
310+ {
323311 return NGX_CONF_ERROR ;
312+ }
313+ else
314+ {
315+ var_name -> data = buf ;
316+ var_name -> len = var_name_len ;
317+
318+ // NGX_HTTP_VAR_CHANGEABLE simplifies the required logic by assuming a JWT claim will always be the same for a given request
319+ ngx_http_variable_t * http_var = ngx_http_add_variable (cf , var_name , NGX_HTTP_VAR_CHANGEABLE );
320+
321+ if (http_var == NULL )
322+ {
323+ ngx_log_error (NGX_LOG_ERR , cf -> log , 0 , "failed to add variable %V" , var_name );
324+
325+ return NGX_CONF_ERROR ;
326+ }
327+ else
328+ {
329+ http_var -> get_handler = get_jwt_var_claim ;
330+
331+ // store the index of this new claim in the claims array as the "data" that will be passed to the getter
332+ ngx_uint_t * claim_idx = ngx_palloc (cf -> pool , sizeof (ngx_uint_t ));
333+
334+ if (claim_idx == NULL )
335+ {
336+ return NGX_CONF_ERROR ;
337+ }
338+ else
339+ {
340+ * claim_idx = claims -> nelts - 1 ;
341+ http_var -> data = (uintptr_t ) claim_idx ;
342+ }
343+ }
344+ }
324345 }
325- * claim_idx = claims -> nelts - 1 ;
326- http_var -> data = (uintptr_t ) claim_idx ;
327346 }
328347
329348 return NGX_CONF_OK ;
@@ -333,21 +352,26 @@ static ngx_int_t get_jwt_var_claim(ngx_http_request_t *r, ngx_http_variable_valu
333352{
334353 ngx_log_debug (NGX_LOG_DEBUG_HTTP , r -> connection -> log , 0 , "getting jwt value for var index %l" , * ((ngx_uint_t * ) data ));
335354 auth_jwt_ctx_t * ctx = get_request_jwt_ctx (r );
355+
336356 if (ctx == NULL )
337357 {
338358 ngx_log_debug (NGX_LOG_DEBUG_HTTP , r -> connection -> log , 0 , "no module context found while getting jwt value" );
359+
339360 return NGX_ERROR ;
340361 }
341-
342- ngx_uint_t * claim_idx = (ngx_uint_t * ) data ;
343- ngx_str_t claim_value = ((ngx_str_t * ) ctx -> claim_values -> elts )[* claim_idx ];
344- v -> valid = 1 ;
345- v -> no_cacheable = 0 ;
346- v -> not_found = 0 ;
347- v -> len = claim_value .len ;
348- v -> data = claim_value .data ;
349-
350- return NGX_OK ;
362+ else
363+ {
364+ ngx_uint_t * claim_idx = (ngx_uint_t * ) data ;
365+ ngx_str_t claim_value = ((ngx_str_t * ) ctx -> claim_values -> elts )[* claim_idx ];
366+
367+ v -> valid = 1 ;
368+ v -> no_cacheable = 0 ;
369+ v -> not_found = 0 ;
370+ v -> len = claim_value .len ;
371+ v -> data = claim_value .data ;
372+
373+ return NGX_OK ;
374+ }
351375}
352376
353377static char * merge_extract_claims (ngx_conf_t * cf , ngx_array_t * claims )
@@ -396,32 +420,37 @@ static char *merge_extract_response_claims(ngx_conf_t *cf, ngx_command_t *cmd, v
396420static auth_jwt_ctx_t * get_or_init_jwt_module_ctx (ngx_http_request_t * r , auth_jwt_conf_t * jwtcf )
397421{
398422 auth_jwt_ctx_t * ctx = ngx_http_get_module_ctx (r , ngx_http_auth_jwt_module );
423+
399424 if (ctx != NULL )
400425 {
401426 return ctx ;
402427 }
403-
404- // context does not yet exist, so let's create one, initialize it, and set it
405- ctx = ngx_pcalloc (r -> pool , sizeof (auth_jwt_ctx_t ));
406- if (ctx == NULL )
407- {
408- ngx_log_error (NGX_LOG_ERR , r -> connection -> log , 0 , "error allocating jwt module context" );
409- return ctx ;
410- }
411-
412- if (jwtcf -> extract_claims != NULL )
428+ else
413429 {
414- ctx -> claim_values = ngx_array_create (r -> pool , jwtcf -> extract_claims -> nelts , sizeof (ngx_str_t ));
415- if (ctx -> claim_values == NULL )
430+ // context does not yet exist, so let's create one, initialize it, and set it
431+ ctx = ngx_pcalloc (r -> pool , sizeof (auth_jwt_ctx_t ));
432+
433+ if (ctx == NULL )
416434 {
417- ngx_log_error (NGX_LOG_ERR , r -> connection -> log , 0 , "error initializing jwt module context" );
418- return NULL ;
435+ ngx_log_error (NGX_LOG_ERR , r -> connection -> log , 0 , "error allocating jwt module context" );
436+ return ctx ;
437+ }
438+ else if (jwtcf -> extract_claims != NULL )
439+ {
440+ ctx -> claim_values = ngx_array_create (r -> pool , jwtcf -> extract_claims -> nelts , sizeof (ngx_str_t ));
441+
442+ if (ctx -> claim_values == NULL )
443+ {
444+ ngx_log_error (NGX_LOG_ERR , r -> connection -> log , 0 , "error initializing jwt module context" );
445+ return NULL ;
446+ }
419447 }
448+
449+ ctx -> validation_status = NGX_AGAIN ;
450+ ngx_http_set_ctx (r , ctx , ngx_http_auth_jwt_module );
451+
452+ return ctx ;
420453 }
421-
422- ctx -> validation_status = NGX_AGAIN ;
423- ngx_http_set_ctx (r , ctx , ngx_http_auth_jwt_module );
424- return ctx ;
425454}
426455
427456// this creates the module's context struct and extracts claim vars the first time it is called,
@@ -592,28 +621,33 @@ static int validate_sub(auth_jwt_conf_t *jwtcf, jwt_t *jwt)
592621static ngx_int_t extract_var_claims (ngx_http_request_t * r , auth_jwt_conf_t * jwtcf , jwt_t * jwt , auth_jwt_ctx_t * ctx )
593622{
594623 ngx_array_t * claims = jwtcf -> extract_claims ;
624+
595625 if (claims == NULL || claims -> nelts == 0 )
596626 {
597627 return NGX_OK ;
598628 }
599-
600- const ngx_str_t * claimsPtr = claims -> elts ;
601-
602- for (uint i = 0 ; i < claims -> nelts ; ++ i )
629+ else
603630 {
604- const ngx_str_t claim = claimsPtr [i ];
605- const char * value = jwt_get_grant (jwt , (char * )claim .data );
606-
607- ngx_str_t nsval = ngx_string ("" );
608- if (value != NULL && strlen (value ) > 0 )
631+ const ngx_str_t * claimsPtr = claims -> elts ;
632+
633+ for (uint i = 0 ; i < claims -> nelts ; ++ i )
609634 {
610- nsval = char_ptr_to_ngx_str_t (r -> pool , value );
635+ const ngx_str_t claim = claimsPtr [i ];
636+ const char * value = jwt_get_grant (jwt , (char * )claim .data );
637+
638+ ngx_str_t nsval = ngx_string ("" );
639+
640+ if (value != NULL && strlen (value ) > 0 )
641+ {
642+ nsval = char_ptr_to_ngx_str_t (r -> pool , value );
643+ }
644+
645+ ((ngx_str_t * ) ctx -> claim_values -> elts )[i ] = nsval ;
646+ ngx_log_debug (NGX_LOG_DEBUG_HTTP , r -> connection -> log , 0 , "set jwt var %V to value %s" , & claim , nsval .data );
611647 }
612- (( ngx_str_t * ) ctx -> claim_values -> elts )[ i ] = nsval ;
613- ngx_log_debug ( NGX_LOG_DEBUG_HTTP , r -> connection -> log , 0 , "set jwt var %V to value %s" , & claim , nsval . data ) ;
648+
649+ return NGX_OK ;
614650 }
615-
616- return NGX_OK ;
617651}
618652
619653static void extract_claims (ngx_http_request_t * r , jwt_t * jwt , ngx_array_t * claims , ngx_int_t (* set_header )(ngx_http_request_t * r , ngx_str_t * key , ngx_str_t * value ))
0 commit comments