From 4f8341e04e7b87db34901c7f42dfe73eb2d9be09 Mon Sep 17 00:00:00 2001 From: Jocelyn Fiat Date: Fri, 16 Nov 2018 19:26:12 +0100 Subject: [PATCH] Updated JWT library with class descriptions and better features names. JWT library fixed to use agorithms names in upper case. Updated README. --- library/security/jwt/src/jwt.e | 1 + library/security/jwt/src/jwt_alg.e | 3 +-- library/security/jwt/src/jwt_alg_hs256.e | 5 ++-- library/security/jwt/src/jwt_alg_none.e | 5 ++-- library/security/jwt/src/jwt_algorithms.e | 5 ++-- library/security/jwt/src/jwt_claimset.e | 5 ++-- library/security/jwt/src/jwt_header.e | 30 ++++++++++++++++++++--- library/security/jwt/src/jwt_utilities.e | 1 - library/security/jwt/testing/test_jwt.e | 16 ++++++++++++ 9 files changed, 53 insertions(+), 18 deletions(-) diff --git a/library/security/jwt/src/jwt.e b/library/security/jwt/src/jwt.e index 2053a6af..07115196 100644 --- a/library/security/jwt/src/jwt.e +++ b/library/security/jwt/src/jwt.e @@ -2,6 +2,7 @@ note description: "JSON Web Token" date: "$Date$" revision: "$Revision$" + EIS: "name=JSON Web Token (JWT)", "src=https://tools.ietf.org/html/rfc7519", "protocol=uri" deferred class JWT diff --git a/library/security/jwt/src/jwt_alg.e b/library/security/jwt/src/jwt_alg.e index 30a97a6e..dbb7a98d 100644 --- a/library/security/jwt/src/jwt_alg.e +++ b/library/security/jwt/src/jwt_alg.e @@ -1,6 +1,5 @@ note - description: "Summary description for {JWT_ALG}." - author: "" + description: "JWT signature is based on Current algorithm" date: "$Date$" revision: "$Revision$" diff --git a/library/security/jwt/src/jwt_alg_hs256.e b/library/security/jwt/src/jwt_alg_hs256.e index 5b5394b2..fee733ac 100644 --- a/library/security/jwt/src/jwt_alg_hs256.e +++ b/library/security/jwt/src/jwt_alg_hs256.e @@ -1,6 +1,5 @@ note - description: "Summary description for {JWT_ALG_HS256}." - author: "" + description: "JWT signature is based on HS256=HMAC+SHA256 algorithm." date: "$Date$" revision: "$Revision$" @@ -12,7 +11,7 @@ inherit feature -- Access - name: STRING = "hs256" + name: STRING = "HS256" encoded_string (a_message: READABLE_STRING_8; a_secret: READABLE_STRING_8): STRING do diff --git a/library/security/jwt/src/jwt_alg_none.e b/library/security/jwt/src/jwt_alg_none.e index 04358452..9136cd6c 100644 --- a/library/security/jwt/src/jwt_alg_none.e +++ b/library/security/jwt/src/jwt_alg_none.e @@ -1,9 +1,8 @@ note - description: "Summary description for {JWT_ALG_NONE}." - author: "" + description: "Object representing algorithm `NONE'" date: "$Date$" revision: "$Revision$" - + EIS: "name=Algorithm none", "src=https://tools.ietf.org/html/rfc7518#section-3.6", "protocol=uri" class JWT_ALG_NONE diff --git a/library/security/jwt/src/jwt_algorithms.e b/library/security/jwt/src/jwt_algorithms.e index 6a41964f..30102a96 100644 --- a/library/security/jwt/src/jwt_algorithms.e +++ b/library/security/jwt/src/jwt_algorithms.e @@ -1,8 +1,9 @@ note - description: "Summary description for {JWT_ALGORITHMS}." - author: "" + description: "JSON Web Algorithms (JWA)" date: "$Date$" revision: "$Revision$" + EIS: "name= JSON Web Algorithms", "src=https://tools.ietf.org/html/rfc7518", "protocol=uri" + class JWT_ALGORITHMS diff --git a/library/security/jwt/src/jwt_claimset.e b/library/security/jwt/src/jwt_claimset.e index 6e45bb71..f04656f7 100644 --- a/library/security/jwt/src/jwt_claimset.e +++ b/library/security/jwt/src/jwt_claimset.e @@ -1,9 +1,8 @@ note - description: "Summary description for {JWT_CLAIMSET}." - author: "" + description: "Object representing a JWT claim set" date: "$Date$" revision: "$Revision$" - + EIS: "name=JWT claims", "src=https://tools.ietf.org/html/rfc7519#section-4", "protocol=uri" class JWT_CLAIMSET diff --git a/library/security/jwt/src/jwt_header.e b/library/security/jwt/src/jwt_header.e index 0d85990a..118a6265 100644 --- a/library/security/jwt/src/jwt_header.e +++ b/library/security/jwt/src/jwt_header.e @@ -6,7 +6,8 @@ note ]" date: "$Date$" revision: "$Revision$" - + EIS: "name=JOSE Header", "src=https://tools.ietf.org/html/rfc7519#section-5", "protocol=uri" + class JWT_HEADER @@ -52,6 +53,10 @@ feature -- Access -- The issuer can freely set an algorithm to verify the signature on the token. -- However, some supported algorithms are insecure. + private_key_id: detachable READABLE_STRING_8 + -- For the kid field in the header, specify your service account's private key ID. + -- You can find this value in the private_key_id field of your service account JSON file. + feature -- Conversion string: STRING @@ -67,7 +72,13 @@ feature -- Conversion end Result.append (",%"alg%":%"") Result.append (algorithm) - Result.append ("%"}") + Result.append ("%"") + if attached private_key_id as kid then + Result.append (",%"kid%":%"") + Result.append (kid) + Result.append ("%"") + end + Result.append ("}") end feature -- Element change @@ -84,13 +95,21 @@ feature -- Element change set_algorithm (alg: detachable READABLE_STRING_8) do - if alg = Void then + if + alg = Void or else + alg.is_case_insensitive_equal ("none") + then algorithm := "none" else - algorithm := alg + algorithm := alg.as_upper end end + set_private_key_id (a_id: detachable READABLE_STRING_8) + do + private_key_id := a_id + end + feature -- Element change import_json (a_json: READABLE_STRING_8) @@ -111,6 +130,9 @@ feature -- Element change if attached {JSON_STRING} jo.item ("alg") as j_alg then set_algorithm (j_alg.unescaped_string_8) end + if attached {JSON_STRING} jo.item ("kid") as j_kid then + set_private_key_id (j_kid.unescaped_string_8) + end end end diff --git a/library/security/jwt/src/jwt_utilities.e b/library/security/jwt/src/jwt_utilities.e index 58d99204..b45b5ef1 100644 --- a/library/security/jwt/src/jwt_utilities.e +++ b/library/security/jwt/src/jwt_utilities.e @@ -1,6 +1,5 @@ note description: "Summary description for {JWT_UTILITIES}." - author: "" date: "$Date$" revision: "$Revision$" diff --git a/library/security/jwt/testing/test_jwt.e b/library/security/jwt/testing/test_jwt.e index ca4c2068..05ba6fa6 100644 --- a/library/security/jwt/testing/test_jwt.e +++ b/library/security/jwt/testing/test_jwt.e @@ -57,6 +57,22 @@ feature -- Test assert ("signature", jwt.encoded_string ("secret").same_string ("eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.pcHcZspUvuiqIPVB_i_qmcvCJv63KLUgIAKIlXI1gY8")) end + test_jwt_alg_caseless + local + jwt: JWS + ut: JWT_UTILITIES + do + create jwt + jwt.set_algorithm ("HS256") + assert("HS256", jwt.algorithm.same_string ("HS256")) + create jwt + jwt.set_algorithm ("hs256") + assert("hs256", jwt.algorithm.same_string ("HS256")) + create jwt + jwt.set_algorithm ("None") + assert("None", jwt.algorithm.same_string ("none")) + end + test_jwt local jwt: JWS