Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow to skip "issued at" validation #297

Merged
merged 5 commits into from
Jan 12, 2019
Merged

Allow to skip "issued at" validation #297

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2d61d32
Issue#254: iat validation will be done by default and it can be ignor…
Oct 30, 2018
15ab908
ignoring the sysouts added while testing
Oct 30, 2018
c9b6f29
Updated the code with review comments
Jan 11, 2019
1ec7669
Merge remote-tracking branch 'upstream/master' into issue254
Jan 12, 2019
89400ad
Formatter method and moved the ignoreIssuedAt to appropriate place
Jan 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 23 additions & 11 deletions lib/src/main/java/com/auth0/jwt/JWTVerifier.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ public static class BaseVerification implements Verification {
private final Algorithm algorithm;
private final Map<String, Object> claims;
private long defaultLeeway;
private boolean ignoreIssuedAt;

BaseVerification(Algorithm algorithm) throws IllegalArgumentException {
if (algorithm == null) {
Expand Down Expand Up @@ -150,6 +151,14 @@ public Verification acceptIssuedAt(long leeway) throws IllegalArgumentException
return this;
}

/**
* Call this method to skip the default issued_at verification
complanboy2 marked this conversation as resolved.
Show resolved Hide resolved
*/
public Verification ignoreIssuedAt() {
this.ignoreIssuedAt = true;
return this;
}

/**
* Require a specific JWT Id ("jti") claim.
*
Expand Down Expand Up @@ -316,17 +325,20 @@ private void assertNonNull(String name) {
}
}

private void addLeewayToDateClaims() {
if (!claims.containsKey(PublicClaims.EXPIRES_AT)) {
claims.put(PublicClaims.EXPIRES_AT, defaultLeeway);
}
if (!claims.containsKey(PublicClaims.NOT_BEFORE)) {
claims.put(PublicClaims.NOT_BEFORE, defaultLeeway);
}
if (!claims.containsKey(PublicClaims.ISSUED_AT)) {
claims.put(PublicClaims.ISSUED_AT, defaultLeeway);
}
}
private void addLeewayToDateClaims() {
complanboy2 marked this conversation as resolved.
Show resolved Hide resolved
if (!claims.containsKey(PublicClaims.EXPIRES_AT)) {
claims.put(PublicClaims.EXPIRES_AT, defaultLeeway);
}
if (!claims.containsKey(PublicClaims.NOT_BEFORE)) {
claims.put(PublicClaims.NOT_BEFORE, defaultLeeway);
}
if (!claims.containsKey(PublicClaims.ISSUED_AT)) {
claims.put(PublicClaims.ISSUED_AT, defaultLeeway);
}
if(ignoreIssuedAt) {
complanboy2 marked this conversation as resolved.
Show resolved Hide resolved
claims.remove(PublicClaims.ISSUED_AT);
}
}

private void requireClaim(String name, Object value) {
if (value == null) {
Expand Down
2 changes: 2 additions & 0 deletions lib/src/main/java/com/auth0/jwt/interfaces/Verification.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,5 +37,7 @@ public interface Verification {

Verification withArrayClaim(String name, Integer... items) throws IllegalArgumentException;

Verification ignoreIssuedAt();

JWTVerifier build();
}
41 changes: 33 additions & 8 deletions lib/src/test/java/com/auth0/jwt/JWTVerifierTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -478,19 +478,30 @@ public void shouldThrowOnNegativeNotBeforeLeeway() throws Exception {
.acceptNotBefore(-1);
}

// Issued At
// Issued At with future date
@Test (expected = InvalidClaimException.class)
public void shouldThrowOnFutureIssuedAt() throws Exception {
Clock clock = mock(Clock.class);
when(clock.getToday()).thenReturn(new Date(DATE_TOKEN_MS_VALUE - 1000));

String token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE0Nzc1OTJ9.CWq-6pUXl1bFg81vqOUZbZrheO2kUBd2Xr3FUZmvudE";
JWTVerifier.BaseVerification verification = (JWTVerifier.BaseVerification) JWTVerifier.init(Algorithm.HMAC256("secret"));

DecodedJWT jwt = verification.build(clock).verify(token);
assertThat(jwt, is(notNullValue()));
}

// Issued At with future date and ignore flag
@Test
public void shouldValidateIssuedAtWithLeeway() throws Exception {
public void shouldSkipIssuedAtVerificationWhenFlagIsPassed() throws Exception {
Clock clock = mock(Clock.class);
when(clock.getToday()).thenReturn(new Date(DATE_TOKEN_MS_VALUE - 1000));

String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE0Nzc1OTJ9.0WJky9eLN7kuxLyZlmbcXRL3Wy8hLoNCEk5CCl2M4lo";
JWTVerifier.BaseVerification verification = (JWTVerifier.BaseVerification) JWTVerifier.init(Algorithm.HMAC256("secret"))
.acceptIssuedAt(2);
DecodedJWT jwt = verification
.build(clock)
.verify(token);
String token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE0Nzc1OTJ9.CWq-6pUXl1bFg81vqOUZbZrheO2kUBd2Xr3FUZmvudE";
JWTVerifier.BaseVerification verification = (JWTVerifier.BaseVerification) JWTVerifier.init(Algorithm.HMAC256("secret"));
verification.ignoreIssuedAt();

DecodedJWT jwt = verification.build(clock).verify(token);
assertThat(jwt, is(notNullValue()));
}

complanboy2 marked this conversation as resolved.
Show resolved Hide resolved
Expand All @@ -508,6 +519,20 @@ public void shouldThrowOnInvalidIssuedAtIfPresent() throws Exception {
.verify(token);
}

@Test
public void shouldOverrideAcceptIssuedAtWhenIgnoreIssuedAtFlagPassedAndSkipTheVerification() throws Exception {
Clock clock = mock(Clock.class);
when(clock.getToday()).thenReturn(new Date(DATE_TOKEN_MS_VALUE - 1000));

String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE0Nzc1OTJ9.0WJky9eLN7kuxLyZlmbcXRL3Wy8hLoNCEk5CCl2M4lo";
JWTVerifier.BaseVerification verification = (JWTVerifier.BaseVerification) JWTVerifier.init(Algorithm.HMAC256("secret"));
DecodedJWT jwt = verification.acceptIssuedAt(20).ignoreIssuedAt()
.build()
.verify(token);

assertThat(jwt, is(notNullValue()));
}

@Test
public void shouldValidateIssuedAtIfPresent() throws Exception {
Clock clock = mock(Clock.class);
Expand Down