浅谈基于Token的WEB后台认证机制

{ "iss" : "online jwt builder" ,

  "iat" : 1416797419 ,

  "exp" : 1448333419 ,

  "aud" : "www.example.com" ,

  "sub" : "jrocket@example.com" ,

  "givenname" : "johnny" ,

  "surname" : "rocket" ,

  "email" : "jrocket@example.com" ,

  "role" : [ "manager" , "project administrator" ]

}

{

"typ" : "jwt" ,

"alg" : "hs256"

}

eyj0exaioijkv1qilcjhbgcioijiuzi1nij9

rswamyaywuhco7ifagd1orpsp7nzl7bf5t7itqpkvim

import javax.crypto.spec.secretkeyspec;

import javax.xml.bind.datatypeconverter;

import java.security.key;

import io.jsonwebtoken.*;

import java.util.date; 

//sample method to construct a jwt

private string createjwt(string id, string issuer, string subject, long ttlmillis) {

//the jwt signature algorithm we will be using to sign the token

signaturealgorithm signaturealgorithm = signaturealgorithm.hs256;

long nowmillis = system.currenttimemillis();

date now = new date(nowmillis);

//we will sign our jwt with our apikey secret

byte [] apikeysecretbytes = datatypeconverter.parsebase64binary(apikey.getsecret());

key signingkey = new secretkeyspec(apikeysecretbytes, signaturealgorithm.getjcaname());

  //let's set the jwt claims

jwtbuilder builder = jwts.builder().setid(id)

                 .setissuedat(now)

                 .setsubject(subject)

                 .setissuer(issuer)

                 .signwith(signaturealgorithm, signingkey);

//if it has been specified, let's add the expiration

if (ttlmillis >= 0 ) {

   long expmillis = nowmillis + ttlmillis;

   date exp = new date(expmillis);

   builder.setexpiration(exp);

}

//builds the jwt and serializes it to a compact, url-safe string

return builder.compact();

}

import javax.xml.bind.datatypeconverter;

import io.jsonwebtoken.jwts;

import io.jsonwebtoken.claims;

//sample method to validate and read the jwt

private void parsejwt(string jwt) {

//this line will throw an exception if it is not a signed jws (as expected)

claims claims = jwts.parser()   

   .setsigningkey(datatypeconverter.parsebase64binary(apikey.getsecret()))

   .parseclaimsjws(jwt).getbody();

system.out.println( "id: " + claims.getid());

system.out.println( "subject: " + claims.getsubject());

system.out.println( "issuer: " + claims.getissuer());

system.out.println( "expiration: " + claims.getexpiration());

}

//设置cookie

response.addheader( "set-cookie" , "uid=112; path=/; httponly" );

//设置多个cookie

response.addheader( "set-cookie" , "uid=112; path=/; httponly" );

response.addheader( "set-cookie" , "timeout=30; path=/test; httponly" );

//设置https的cookie

response.addheader( "set-cookie" , "uid=112; path=/; secure; httponly" );

auth_header = jwt.encode({

  user_id: 123 ,

  iat: time.now.to_i,   # 指定token发布时间

  exp: time.now.to_i + 2   # 指定token过期时间为 2 秒后， 2 秒时间足够一次http请求，同时在一定程度确保上一次token过期，减少replay attack的概率；

}, "<my shared secret>" )

restclient.get( "http://api.example.com/" , authorization: auth_header)

class apicontroller < actioncontroller::base

  attr_reader :current_user

  before_action :set_current_user_from_jwt_token

  def set_current_user_from_jwt_token

   # step 1 :解码jwt，并获取user id，这个时候不对token签名进行检查

   # the signature. note jwt tokens are *not* encrypted, but signed.

   payload = jwt.decode(request.authorization, nil, false )

   # step 2 : 检查该用户是否存在于数据库

   @current_user = user.find(payload[ 'user_id' ])

   # step 3 : 检查token签名是否正确.

   jwt.decode(request.authorization, current_user.api_secret)

   # step 4 : 检查 "iat" 和 "exp" 以确保这个token是在 2 秒内创建的.

   now = time.now.to_i

   if payload[ 'iat' ] > now || payload[ 'exp' ] < now

    # 如果过期则返回 401

   end

  rescue jwt::decodeerror

   # 返回 401

  end

end

auth_header = jwt.encode({

  user_id: 123 ,

  jti: rand( 2 << 64 ).to_s, # 通过jti确保一个token只使用一次，防止replace attack

  iat: time.now.to_i,    # 指定token发布时间.

  exp: time.now.to_i + 2   # 指定token过期时间为 2 秒后

}, "<my shared secret>" )

restclient.get( "http://api.example.com/" , authorization: auth_header)

def set_current_user_from_jwt_token

  # 前面的步骤参考上面

  payload = jwt.decode(request.authorization, nil, false )

  @current_user = user.find(payload[ 'user_id' ])

  jwt.decode(request.authorization, current_user.api_secret)

  now = time.now.to_i

  if payload[ 'iat' ] > now || payload[ 'exp' ] < now

   # 返回 401

  end

  # 下面将检查确保这个jwt之前没有被使用过

  # 使用redis的原子操作

  # the redis 的键: <user id>:<one-time use token>

  key = "#{payload['user_id']}:#{payload['jti']}"

  # 看键值是否在redis中已经存在. 如果不存在则返回nil. 如果存在则返回[ 1 ]. .

  if redis.getset(key, "1" )

   # 返回 401

   #

  end

  # 进行键值过期检查

  redis.expireat(key, payload[ 'exp' ] + 2 )

end