Merge pull request #18 from auth0-samples/use-go-jwt-middleware

Use go jwt middleware to decode and verify tokens

Author: aaguiarz

.gitignore

@@ -1,2 +1,3 @@
 .DS_Store
 .env
+src

01-Authorization-RS256/main.go

@@ -5,133 +5,173 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
+	"errors"
+	"log"
+	"os"
 
-	auth0 "github.com/auth0-community/go-auth0"
+	"github.com/codegangsta/negroni"
+	"github.com/auth0/go-jwt-middleware"
+	"github.com/dgrijalva/jwt-go"
 	"github.com/gorilla/mux"
-	jose "gopkg.in/square/go-jose.v2"
-	jwt "gopkg.in/square/go-jose.v2/jwt"
 	"github.com/joho/godotenv"
-	"log"
-	"os"
 )
 
 type Response struct {
 	Message string `json:"message"`
 }
 
+type Jwks struct {
+	Keys []JSONWebKeys `json:"keys"`
+}
+
+type JSONWebKeys struct {
+	Kty string `json:"kty"`
+	Kid string `json:"kid"`
+	Use string `json:"use"`
+	N string `json:"n"`
+	E string `json:"e"`
+	X5c []string `json:"x5c"`
+}
+
 func main() {
 
 	err := godotenv.Load()
 	if err != nil {
 		log.Print("Error loading .env file")
 	}
 
+	jwtMiddleware := jwtmiddleware.New(jwtmiddleware.Options {
+		ValidationKeyGetter: func(token *jwt.Token) (interface{}, error) {
+			// Verify 'aud' claim
+			aud := os.Getenv("AUTH0_AUDIENCE")
+			checkAud := token.Claims.(jwt.MapClaims).VerifyAudience(aud, false)
+			if !checkAud {
+				return token, errors.New("Invalid audience.")
+			}
+			// Verify 'iss' claim
+			iss := "https://" + os.Getenv("AUTH0_DOMAIN") + "/"
+			checkIss := token.Claims.(jwt.MapClaims).VerifyIssuer(iss, false)
+			if !checkIss {
+				return token, errors.New("Invalid issuer.")
+			}
+
+			cert, err := getPemCert(token)
+			if err != nil {
+				panic(err.Error())
+			}
+
+			result, _ := jwt.ParseRSAPublicKeyFromPEM([]byte(cert))
+			return result, nil
+		},
+		SigningMethod: jwt.SigningMethodRS256,
+	})
+
 	r := mux.NewRouter()
 
 	// This route is always accessible
 	r.Handle("/api/public", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response := Response{
-			Message: "Hello from a public endpoint! You don't need to be authenticated to see this.",
-		}
-
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		json.NewEncoder(w).Encode(response)
+		message := "Hello from a public endpoint! You don't need to be authenticated to see this."
+		responseJSON(message, w, http.StatusOK)
 	}))
 
 	// This route is only accessible if the user has a valid access_token
-	// We are wrapping the checkJwt middleware around the handler function which will check for a valid token.
-	r.Handle("/api/private", checkJwt(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		response := Response{
-			Message: "Hello from a private endpoint! You need to be authenticated to see this.",
-		}
-
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		json.NewEncoder(w).Encode(response)
-
-	})))
+	// We are chaining the jwtmiddleware middleware into the negroni handler function which will check
+	// for a valid token.
+	r.Handle("/api/private", negroni.New(
+		negroni.HandlerFunc(jwtMiddleware.HandlerWithNext),
+		negroni.Wrap(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			message := "Hello from a private endpoint! You need to be authenticated to see this."
+			responseJSON(message, w, http.StatusOK)
+	}))))
 
 	// This route is only accessible if the user has a valid access_token with the read:messages scope
-	// We are wrapping the checkJwt middleware around the handler function which will check for a
-	// valid token and scope.
-	r.Handle("/api/private-scoped", checkJwt(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Ensure the token has the correct scope
-		JWKS_URI := "https://" + os.Getenv("AUTH0_DOMAIN") + "/.well-known/jwks.json"
-		client := auth0.NewJWKClient(auth0.JWKClientOptions{URI: JWKS_URI})
-		aud := os.Getenv("AUTH0_AUDIENCE")
-		audience := []string{aud}
-
-		var AUTH0_API_ISSUER = "https://" + os.Getenv("AUTH0_DOMAIN") + "/"
-		configuration := auth0.NewConfiguration(client, audience, AUTH0_API_ISSUER, jose.RS256)
-		validator := auth0.NewValidator(configuration)
-		token, _ := validator.ValidateRequest(r)
-		result := checkScope(r, validator, token)
-		if result == true {
-			response := Response{
-				Message: "Hello from a private endpoint! You need to be authenticated and have a scope of read:messages to see this.",
-			}
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusOK)
-			json.NewEncoder(w).Encode(response)
-		} else {
-			response := Response{
-				Message: "You do not have the read:messages scope.",
+	// We are chaining the jwtmiddleware middleware into the negroni handler function which will check
+	// for a valid token and and scope.
+	r.Handle("/api/private-scoped", negroni.New(
+		negroni.HandlerFunc(jwtMiddleware.HandlerWithNext),
+		negroni.Wrap(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			authHeaderParts := strings.Split(r.Header.Get("Authorization"), " ")
+			token := authHeaderParts[1]
+
+			hasScope := checkScope("read:messages", token)
+
+			if !hasScope {
+				message := "Insufficient scope."
+				responseJSON(message, w, http.StatusForbidden)
+				return
 			}
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusForbidden)
-			json.NewEncoder(w).Encode(response)
+			message := "Hello from a private endpoint! You need to be authenticated to see this."
+			responseJSON(message, w, http.StatusOK)
+	}))))
 
-		}
+	http.Handle("/", r)
+	fmt.Println("Listening on http://localhost:3010")
+	http.ListenAndServe("0.0.0.0:3010", nil)
+}
 
-	})))
 
-	fmt.Println("Listening on http://localhost:3010")
-	http.ListenAndServe("0.0.0.0:3010", r)
+type CustomClaims struct {
+	Scope string `json:"scope"`
+	jwt.StandardClaims
 }
 
-func checkJwt(h http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		JWKS_URI := "https://" + os.Getenv("AUTH0_DOMAIN") + "/.well-known/jwks.json"
-		client := auth0.NewJWKClient(auth0.JWKClientOptions{URI: JWKS_URI})
-		aud := os.Getenv("AUTH0_AUDIENCE")
-		audience := []string{aud}
+func checkScope(scope string, tokenString string) bool {
+	token, _ := jwt.ParseWithClaims(tokenString, &CustomClaims{}, nil)
+
+	claims, _ := token.Claims.(*CustomClaims)
 
-		var AUTH0_API_ISSUER = "https://" + os.Getenv("AUTH0_DOMAIN") + "/"
-		configuration := auth0.NewConfiguration(client, audience, AUTH0_API_ISSUER, jose.RS256)
-		validator := auth0.NewValidator(configuration)
+	hasScope := false
+	result := strings.Split(claims.Scope, " ")
+	for i := range result {
+		if result[i] == scope {
+			hasScope = true
+		}
+	}
 
-		_, err := validator.ValidateRequest(r)
+	return hasScope
+}
 
-		if err != nil {
-			fmt.Println("Token is not valid or missing token")
+func getPemCert(token *jwt.Token) (string, error) {
+	cert := ""
+	resp, err := http.Get("https://" + os.Getenv("AUTH0_DOMAIN") + "/.well-known/jwks.json")
 
-			response := Response{
-				Message: "Missing or invalid token.",
-			}
+	if err != nil {
+		return cert, err
+	}
+	defer resp.Body.Close()
 
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusUnauthorized)
-			json.NewEncoder(w).Encode(response)
+	var jwks = Jwks{}
+	err = json.NewDecoder(resp.Body).Decode(&jwks)
 
-		} else {
-			h.ServeHTTP(w, r)
+	if err != nil {
+		return cert, err
+	}
+
+	x5c := jwks.Keys[0].X5c
+	for k, v := range x5c {
+		if token.Header["kid"] == jwks.Keys[k].Kid {
+			cert = "-----BEGIN CERTIFICATE-----\n" + v + "\n-----END CERTIFICATE-----"
 		}
-	})
+	}
+
+	if cert == "" {
+		err := errors.New("Unable to find appropriate key.")
+		return cert, err
+	}
+
+	return cert, nil
 }
 
-func checkScope(r *http.Request, validator *auth0.JWTValidator, token *jwt.JSONWebToken) bool {
-	claims := map[string]interface{}{}
-	err := validator.Claims(r, token, &claims)
+func responseJSON(message string, w http.ResponseWriter, statusCode int) {
+	response := Response{message}
 
+	jsonResponse, err := json.Marshal(response)
 	if err != nil {
-		fmt.Println(err)
-		return false
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
 	}
 
-	if claims["scope"] != nil && strings.Contains(claims["scope"].(string), "read:messages") {
-		return true
-	} else {
-		return false
-	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+	w.Write(jsonResponse)
 }