The /auth/refresh endpoint return 401 requests with expired accessToken

JWT Auth Proxy

This JWT Auth Proxy is a lightweight authentication proxy written in Go designed for use in Docker/Kubernetes environments.

JWT Auth Proxy sits between your frontend and your application's backend, handles authentication, and proxies authenticated requests to your backend. It offers REST APIs and logic for signup (incl. double-opt-in), password reset ("forgot my password") and verified email address change. This way, your application's backend can focus on the actual business logic, while relying on secure authentication having been performed before.

To your application's backend, the JWT Auth Proxy provides an mTLS-secured REST API for modifying user objects and storing custom data per user.

JWT Auth Proxy uses short-lived JWT access tokens (HMAC-signing with SHA-512) and long-lived UUIDv4 refresh tokens for securely retrieving new access tokens before the old one expires. It supports Two-Factor Authentication (2FA) via Time-based One-Time passwords (TOTP).

Features

User-facing

Easy-to-use REST API for
- Signup with double-opt-in
- Login (with TOTP optionally)
- Logout
- Password reset (forgot password)
- Email address change with double-opt-in
- JWT access token renewal using long-lived refresh tokens
- Activate and disable Two-Factor Authentication (2FA, TOTP)
Proxy authenticated requests to your application's backend
Whitelist backend URLs not requiring authentication (or blacklist)

Application-/Backend-facing

mTLS encrypted connecting (mutual TLS)
Easy-to-use REST API for
- Create user
- Delete user
- Disable/enable user
- Check password
- Set password
- Set email address
- Store and retrieve custom per-user data (JSON)

Example

There is a little sample application in the example folder. It consists of the JWT Auth Proxy, a React-based web frontend and a Go-based application backend. It also contains a MongoDB instance and an instance of the Mailhog fake SMTP server.

To start the example:

git clone https://github.com/virtualzone/jwt-auth-proxy.git
cd jwt-auth-proxy/example
docker-compose up -d

Access the frontend at: http://localhost:8080

To access the Mailhog frontend and check for your signup mail: http://localhost:8025

Documentation

https://jwt-auth-proxy.readthedocs.io

	func VerifyJwtMiddleware(next http.Handler) http.Handler {
	var isWhitelistMatch = func(url string, whitelistedURL string) bool {
	whitelistedURL = strings.TrimSpace(whitelistedURL)
	if strings.HasSuffix(whitelistedURL, "/") {
	whitelistedURL = whitelistedURL[:len(whitelistedURL)-1]
	}
	if whitelistedURL != "" && (url == whitelistedURL \|\| strings.HasPrefix(url, whitelistedURL+"/")) {
	return true
	}
	return false
	}

	var IsWhitelisted = func(r *http.Request) bool {
	url := r.URL.RequestURI()
	// Check for whitelisted public API paths
	for _, whitelistedURL := range unauthorizedRoutes {
	if isWhitelistMatch(url, whitelistedURL) {
	return true
	}
	}
	// All other public API paths require a valid auth token
	if strings.HasPrefix(url, GetConfig().PublicAPIPath) {
	return false
	}
	// Whitelist Mode: Check is URL is whitelisted, else assume auth token is required
	if len(GetConfig().ProxyWhitelist) > 0 {
	for _, whitelistedURL := range GetConfig().ProxyWhitelist {
	if isWhitelistMatch(url, whitelistedURL) {
	return true
	}
	}
	return false
	}
	// Blacklist Mode: Check is URL is blacklisted, else assume auth token is NOT required
	for _, blacklistedURL := range GetConfig().ProxyBlacklist {
	if isWhitelistMatch(url, blacklistedURL) {
	return false
	}
	}
	return true
	}

	var HandleWhitelistReq = func(w http.ResponseWriter, r *http.Request) {
	claims, authHeader, err := ExtractClaimsFromRequest(r)
	if err != nil {
	next.ServeHTTP(w, r)
	return
	}
	ctx := context.WithValue(r.Context(), contextKeyUserID, claims.UserID)
	ctx = context.WithValue(ctx, contextKeyAuthHeader, authHeader)
	next.ServeHTTP(w, r.WithContext(ctx))
	}

	var HandleNonWhitelistReq = func(w http.ResponseWriter, r *http.Request) {
	claims, authHeader, err := ExtractClaimsFromRequest(r)
	if err != nil {
	log.Println(err)
	SendUnauthorized(w)
	return
	}
	ctx := context.WithValue(r.Context(), contextKeyUserID, claims.UserID)
	ctx = context.WithValue(ctx, contextKeyAuthHeader, authHeader)
	next.ServeHTTP(w, r.WithContext(ctx))
	}

	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	if r.Method == "OPTIONS" {
	HandleWhitelistReq(w, r)
	} else if IsWhitelisted(r) {
	HandleWhitelistReq(w, r)
	} else {
	HandleNonWhitelistReq(w, r)
	}
	})
	}

virtualzone / jwt-auth-proxy Goto Github PK

jwt-auth-proxy's Introduction

JWT Auth Proxy

Features

User-facing

Application-/Backend-facing

Example

Documentation

jwt-auth-proxy's People

Contributors

Stargazers

Watchers

Forkers

jwt-auth-proxy's Issues

To reproduce

Expected behavior

Actual behavior

Possible cause

To reproduce

Expected behavior

Actual behavior

Possible cause

Recommend Projects

Recommend Topics

Recommend Org