Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow to skip "issued at" validation #297

Merged
merged 5 commits into from
Jan 12, 2019
+48 −8
Merged

Allow to skip "issued at" validation #297

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2d61d32
Issue#254: iat validation will be done by default and it can be ignor…
Oct 30, 2018
15ab908
ignoring the sysouts added while testing
Oct 30, 2018
c9b6f29
Updated the code with review comments
Jan 11, 2019
1ec7669
Merge remote-tracking branch 'upstream/master' into issue254
Jan 12, 2019
89400ad
Formatter method and moved the ignoreIssuedAt to appropriate place
Jan 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 16 additions & 11 deletions lib/src/main/java/com/auth0/jwt/JWTVerifier.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ public static class BaseVerification implements Verification {
private final Algorithm algorithm;
private final Map<String, Object> claims;
private long defaultLeeway;
private boolean ignoreIssuedAt;

BaseVerification(Algorithm algorithm) throws IllegalArgumentException {
if (algorithm == null) {
Expand Down Expand Up @@ -150,6 +151,10 @@ public Verification acceptIssuedAt(long leeway) throws IllegalArgumentException
return this;
}

public void ignoreIssuedAt() {
complanboy2 marked this conversation as resolved.
Show resolved Hide resolved
this.ignoreIssuedAt = true;
}

/**
* Require a specific JWT Id ("jti") claim.
*
Expand Down Expand Up @@ -316,17 +321,17 @@ private void assertNonNull(String name) {
}
}

private void addLeewayToDateClaims() {
if (!claims.containsKey(PublicClaims.EXPIRES_AT)) {
claims.put(PublicClaims.EXPIRES_AT, defaultLeeway);
}
if (!claims.containsKey(PublicClaims.NOT_BEFORE)) {
claims.put(PublicClaims.NOT_BEFORE, defaultLeeway);
}
if (!claims.containsKey(PublicClaims.ISSUED_AT)) {
claims.put(PublicClaims.ISSUED_AT, defaultLeeway);
}
}
private void addLeewayToDateClaims() {
complanboy2 marked this conversation as resolved.
Show resolved Hide resolved
if (!claims.containsKey(PublicClaims.EXPIRES_AT)) {
claims.put(PublicClaims.EXPIRES_AT, defaultLeeway);
}
if (!claims.containsKey(PublicClaims.NOT_BEFORE)) {
claims.put(PublicClaims.NOT_BEFORE, defaultLeeway);
}
if (!ignoreIssuedAt && !claims.containsKey(PublicClaims.ISSUED_AT)) {
claims.put(PublicClaims.ISSUED_AT, defaultLeeway);
}
}

private void requireClaim(String name, Object value) {
if (value == null) {
Expand Down
27 changes: 27 additions & 0 deletions lib/src/test/java/com/auth0/jwt/JWTVerifierTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -494,6 +494,33 @@ public void shouldValidateIssuedAtWithLeeway() throws Exception {
assertThat(jwt, is(notNullValue()));
}

// Issued At with future date
@Test (expected = InvalidClaimException.class)
complanboy2 marked this conversation as resolved.
Show resolved Hide resolved
public void shouldThrowOnFutureIssuedAt() throws Exception {
Clock clock = mock(Clock.class);
when(clock.getToday()).thenReturn(new Date(DATE_TOKEN_MS_VALUE - 1000));

String token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE0Nzc1OTJ9.CWq-6pUXl1bFg81vqOUZbZrheO2kUBd2Xr3FUZmvudE";
JWTVerifier.BaseVerification verification = (JWTVerifier.BaseVerification) JWTVerifier.init(Algorithm.HMAC256("secret"));

DecodedJWT jwt = verification.build(clock).verify(token);
assertThat(jwt, is(notNullValue()));
}

// Issued At with future date and ignore flag
@Test
public void shouldNotVerifyIATOnIgnoreIssuedAt() throws Exception {
complanboy2 marked this conversation as resolved.
Show resolved Hide resolved
Clock clock = mock(Clock.class);
when(clock.getToday()).thenReturn(new Date(DATE_TOKEN_MS_VALUE - 1000));

String token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE0Nzc1OTJ9.CWq-6pUXl1bFg81vqOUZbZrheO2kUBd2Xr3FUZmvudE";
JWTVerifier.BaseVerification verification = (JWTVerifier.BaseVerification) JWTVerifier.init(Algorithm.HMAC256("secret"));
verification.ignoreIssuedAt();

DecodedJWT jwt = verification.build(clock).verify(token);
assertThat(jwt, is(notNullValue()));
}

complanboy2 marked this conversation as resolved.
Show resolved Hide resolved
@Test
public void shouldThrowOnInvalidIssuedAtIfPresent() throws Exception {
exception.expect(InvalidClaimException.class);
Expand Down