Giter Club home page Giter Club logo

revoke.net's Introduction

Package Name Version Downloads
Revoke.NET Latest version Downloads
Revoke.NET.AspNetCore Latest version Downloads
Revoke.NET.Akavache Latest version Downloads
Revoke.NET.MongoDB Latest version Downloads
Revoke.NET.Redis Latest version Downloads
Revoke.NET.EasyCaching Latest version Downloads

Revoke.NET

.NET Utility to revoke access based on some given criterias including but not limited to:

  • Web Tokens like JWT Bearer token
  • HTTP Request Header Paramters, Query, URL, Host, IP, Cookies, Body, FormData, Claims...etc

Installation

First, install the Revoke.NET into your app

Install-Package Revoke.NET

or with dotnet cli:

dotnet add package Revoke.NET

How to use

simple create a new BlackList Store of type IBlackListStore

using Revoke.NET;

var store = MemoryBlackListStore.CreateStore(); 
// Create a blacklist store, core package come with non-persistent in-memory store

var key = "[ID String of something to be blacklisted]";

await store.Revoke(key, TimeSpan.FromHours(24)); // Revoke access to a key for 24 hours

await store.Revoke(key); // Revoke access indefinetly or with the defaulTtl expiration

var revoked = await store.IsRevoked(key); // Check if key is blacklisted

await store.Delete(key); // Delete a key from blacklist

Usage with ASP.NET Core

Install the Revoke.NET.AspNetCore into your app

Install-Package Revoke.NET.AspNetCore

or with dotnet cli:

dotnet add package Revoke.NET.AspNetCore
using Revoke.NET;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddRevokeStore(() => /*  provide a BlackList Store */)
    .AddHttpContextRevokeMiddleware(
        context => { /* create custom key selector from HttpContext */ },
        response => { /* create a custom response to be sent when a request is revoked */  }
    ); 

JWT Bearer Token Example

using System.Net.Http.Headers;
using Microsoft.AspNetCore.Mvc;
using Revoke.NET;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddRevokeInMemoryStore() // Register a Revoke Store
    .AddJWTBearerTokenRevokeMiddleware(); // Register a Revoke Middleware

var app = builder.Build();

app.UseRevoke(); // Use Middleware before calling UseAuthorization()

app.UseAuthorization();
app.UseAuthentication();

app.MapGet("/logout", async ([FromServices] IBlackListStore store, HttpRequest request) =>
{
    var token = AuthenticationHeaderValue.Parse(request.Headers.Authorization).Parameter;

    await store.Revoke(token);

    return true;
});

app.Run();

revoke.net's People

Contributors

jeffward01 avatar rainxh11 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar

revoke.net's Issues

[Issue] I'd like to fix all of the Async naming conventions to ensure the suffix 'Async' is added wherever possible

Hello,

I'd like to fix all the async methods and ensure all async methods end with the suffix Async - I will also add a CancellationToken cancellationToken = default); wherever possible.

This will be a breaking change as it changes all of the existing Method names.

I suggest that we do (1) of (2) things:

Option 1: Create duplicate methods with the suffix Async then mark the existing methods as [Obsolete] Iterate the version of Revoke.NET from 2.0.1 to 2.1.0`

When it comes time to release 3.0.0 we will remove the [Obsolete] methods

This option is safer, but more painful for development reasons that are obvious.

Option 2: Iterate to version 3.0.0 with the new Suffix of Async - this will be a breaking change. Users who wish to stay on version 2.x.x can do so.


My thoughts are that this is a younger project, so probably not many users, I vote for Option 2

What do you think?

[Question] Can you provide an example or some words on 'Custom Key Selector from HTTP Context?'

VERY cool project!! Its neat to see something so important and crucial implemented so nicely. This is a fantastic library and will become very popular as soon as more people learn about it.

I had a question about:

context => { /* create custom key selector from HttpContext */ },
response => { /* create a custom response to be sent when a request is revoked */  }

image

  • Can you provide an example of the 'custom key selector'? Im not sure what you mean by this. Do you mean like add the Authorization: Bearer <token> key where Authorization is the key? How would this work?

  • Why would anyone want to provide a custom response, is this an HTTP response? I'm not sure why the library will implement this, when the purpose of the library is to maintain a list of revoked keys. Can you please elaborate?

Thanks!

[Roadmap?] [ToDo List?] Do these exist?

Hello!

I think this is a GREAT project, I see so many posts online about how to invalidate JWT tokens, and everyone seems to be a bit clueless.
I very much appreciate this library and would love to contribute.

Do you have a 'to-do' list, or 'roadmap' so that I can start making some pull requests?

Thanks!

[Issue] Is there any reason why this can be null?

Hello,

I was exploring your library and caught an exception during runtime. I had forgot to configure the TimeSpan on the RevokeToken `IserviceCollectionMethod.

RevokeService.cs

    /// <summary>
    ///     Register default InMemory BlackList Store Service using <seealso cref="MemoryCacheBlackList" />
    /// </summary>
    /// <param name="services">The services</param>
    /// <param name="defaultTtl">The default ttl</param>
    /// <returns>The services</returns>
    public static IServiceCollection AddRevokeMemoryCacheStore(this IServiceCollection services, TimeSpan? defaultTtl = null)
    {
        services.TryAddSingleton<IBlackList>(provider => new MemoryCacheBlackList(provider.GetService<IMemoryCache>(), defaultTtl));

        return services;
    }

You know the library better than I do, are there any 'run-time' use-case configurations where defaultTtl will be null and this method will be called?

I understand that null is allowed for this method, however, when Revoke is called while null is configured for defaultTtl an exception is thrown similar to:

"message": "System.ArgumentOutOfRangeException: The added or subtracted value results in an un-representable DateTime. (Parameter 'value')\r\n   at System.DateTime.ThrowDateArithmetic(Int32 param)\r\n   at System.DateTime.AddTicks(Int64 value)\r\n   at System.DateTime.Add(TimeSpan value)\r\n   at Revoke.NET.MemoryBlackList.Revoke(String key)"

I would like to add a null check to ensure that an error is thrown on startup instead of runtime -- However, I am not sure if there is any reason why this will be marked as null during the startup.

Question

Is there any reason why a user will call this method below and be happy with a null value for TimeSpan?

// This or similar... note that the TimeSpan will be null
 services.AddRevokeInMemoryStore().AddJWTBearerTokenRevokeMiddleware();

Propose

  • Option 1: Do nothing, there is a reason why it will be null, ignore it.

  • Option 2: Add a null check that is thrown at runtime if the value is null.

  • Option 3: Remove 'allowed null's for this method

  • Option 4: Add a default value of XX Time in Days or Minutes


You know the library better than I do, what do you suggest?

Thanks

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.