mirror of https://github.com/ethereum/go-ethereum
cmd/geth, node, rpc: implement jwt tokens (#24364)
* rpc, node: refactor request validation and add jwt validation * node, rpc: fix error message, ignore engine api in RegisterAPIs * node: make authenticated port configurable * eth/catalyst: enable unauthenticated version of engine api * node: rework obtainjwtsecret (backport later) * cmd/geth: added auth port flag * node: happy lint, happy life * node: refactor authenticated api Modifies the authentication mechanism to use default values * node: trim spaces and newline away from secret Co-authored-by: Marius van der Wijden <m.vanderwijden@live.de>pull/24507/head
Martin Holst Swende
3 years ago
committed by
GitHub
parent
37f9d25ba0
commit
4860e50e05
@ -0,0 +1,78 @@ |
|||||||
|
// Copyright 2022 The go-ethereum Authors
|
||||||
|
// This file is part of the go-ethereum library.
|
||||||
|
//
|
||||||
|
// The go-ethereum library is free software: you can redistribute it and/or modify
|
||||||
|
// it under the terms of the GNU Lesser General Public License as published by
|
||||||
|
// the Free Software Foundation, either version 3 of the License, or
|
||||||
|
// (at your option) any later version.
|
||||||
|
//
|
||||||
|
// The go-ethereum library is distributed in the hope that it will be useful,
|
||||||
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
// GNU Lesser General Public License for more details.
|
||||||
|
//
|
||||||
|
// You should have received a copy of the GNU Lesser General Public License
|
||||||
|
// along with the go-ethereum library. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
package node |
||||||
|
|
||||||
|
import ( |
||||||
|
"net/http" |
||||||
|
"strings" |
||||||
|
"time" |
||||||
|
|
||||||
|
"github.com/golang-jwt/jwt/v4" |
||||||
|
) |
||||||
|
|
||||||
|
type jwtHandler struct { |
||||||
|
keyFunc func(token *jwt.Token) (interface{}, error) |
||||||
|
next http.Handler |
||||||
|
} |
||||||
|
|
||||||
|
// newJWTHandler creates a http.Handler with jwt authentication support.
|
||||||
|
func newJWTHandler(secret []byte, next http.Handler) http.Handler { |
||||||
|
return &jwtHandler{ |
||||||
|
keyFunc: func(token *jwt.Token) (interface{}, error) { |
||||||
|
return secret, nil |
||||||
|
}, |
||||||
|
next: next, |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
// ServeHTTP implements http.Handler
|
||||||
|
func (handler *jwtHandler) ServeHTTP(out http.ResponseWriter, r *http.Request) { |
||||||
|
var ( |
||||||
|
strToken string |
||||||
|
claims jwt.RegisteredClaims |
||||||
|
) |
||||||
|
if auth := r.Header.Get("Authorization"); strings.HasPrefix(auth, "Bearer ") { |
||||||
|
strToken = strings.TrimPrefix(auth, "Bearer ") |
||||||
|
} |
||||||
|
if len(strToken) == 0 { |
||||||
|
http.Error(out, "missing token", http.StatusForbidden) |
||||||
|
return |
||||||
|
} |
||||||
|
// We explicitly set only HS256 allowed, and also disables the
|
||||||
|
// claim-check: the RegisteredClaims internally requires 'iat' to
|
||||||
|
// be no later than 'now', but we allow for a bit of drift.
|
||||||
|
token, err := jwt.ParseWithClaims(strToken, &claims, handler.keyFunc, |
||||||
|
jwt.WithValidMethods([]string{"HS256"}), |
||||||
|
jwt.WithoutClaimsValidation()) |
||||||
|
|
||||||
|
switch { |
||||||
|
case err != nil: |
||||||
|
http.Error(out, err.Error(), http.StatusForbidden) |
||||||
|
case !token.Valid: |
||||||
|
http.Error(out, "invalid token", http.StatusForbidden) |
||||||
|
case !claims.VerifyExpiresAt(time.Now(), false): // optional
|
||||||
|
http.Error(out, "token is expired", http.StatusForbidden) |
||||||
|
case claims.IssuedAt == nil: |
||||||
|
http.Error(out, "missing issued-at", http.StatusForbidden) |
||||||
|
case time.Since(claims.IssuedAt.Time) > 5*time.Second: |
||||||
|
http.Error(out, "stale token", http.StatusForbidden) |
||||||
|
case time.Until(claims.IssuedAt.Time) > 5*time.Second: |
||||||
|
http.Error(out, "future token", http.StatusForbidden) |
||||||
|
default: |
||||||
|
handler.next.ServeHTTP(out, r) |
||||||
|
} |
||||||
|
} |
||||||
Loading…
Reference in new issue