在没有验证的情况下解码 JWT 并找到范围

Question

我需要解码我的 JWT 令牌并检查范围是否为 "Doctor"。

我对 GO 知之甚少，但我只需要在我的应用程序中编写一个小片段来扩展现有应用程序，所以它需要用 GO 编写。

这是我尝试解码令牌并检查 "Doctor" 是否在解码令牌中，因为我无法独占访问范围。

for k, v := range props {
        token_value := fmt.Sprint(v)
        token_key := fmt.Sprint(cfg.AuthKey)
        if (k == "custom_token_header") && strings.Contains(token_value, token_key) {
            if token, _ := jwt.Parse(token_value, nil); token != nil {
                parsed_token := fmt.Sprint(token)
                log.Infof("Parsed token: " ,parsed_token)
                if strings.Contains(parsed_token, "Doctor")  {
                    log.Infof("user is a Doctor, perform checks...")
                    loc, _ := time.LoadLocation("GMT")
                    now := time.Now().In(loc)
                    hr, _, _ := now.Clock()
                    if hr >= 9 && hr < 5 {
                        log.Infof("success, inside of work hours!!")
                        return &v1beta1.CheckResult{
                            Status: status.OK,
                        }, nil
                    }
                    log.Infof("failure; outside of work hours!!")
                    return &v1beta1.CheckResult{
                        Status: status.WithPermissionDenied("Unauthorized..."),
                    }, nil
                }
            }
            log.Infof("success, as you're not a doctor!!")
            return &v1beta1.CheckResult{
                Status: status.OK,
            }, nil
        }
    }

它在我的应用程序之外工作正常，但是当运行在我的应用程序内部时它很奇怪并且返回这个 <nil> map[] <nil> false 用于声明的位置，但是当运行在外部它给我的应用程序

map[alg:RS256 kid:NUVGODIxQThBQkY2NjExQjgzMEJEMjVBQTc3QThBNTY4QTY3MzhEMA typ:JWT] map[aud:https://rba.com/doctor azp:3XFBbjTL6tsL9wH6iZQtkz3rKgGeiLwh exp:1.55546266e+09 gty:client-credentials iat:1.55537626e+09 iss:https://jor2.eu.auth0.com/ scope:Doctor sub:3XFBbjTL6tsL9wH6iZQtkz3rKgGeiLwh@clients]  false

多亏了 devdotlog，我才能够使用此更改：

for k, v := range props {
        tokenString := fmt.Sprint(v)
        tokenKey := fmt.Sprint(cfg.AuthKey)
        if (k == "custom_token_header") && strings.Contains(tokenString, tokenKey) {
            tokenString = strings.Replace(tokenString, "Bearer ", "", -1)
            token, _, err := new(jwt.Parser).ParseUnverified(tokenString, jwt.MapClaims{})
            if err != nil {
                fmt.Println(err)
                return nil, nil
            }
            if claims, ok := token.Claims.(jwt.MapClaims); ok {
                tokenScope := fmt.Sprint(claims["scope"])
                log.Infof("Scope: ", tokenScope)
                if tokenScope == "Doctor" {
                    log.Infof("user is a Doctor, perform checks...")
                    loc, _ := time.LoadLocation("GMT")
                    now := time.Now().In(loc)
                    hr, _, _ := now.Clock()
                    if hr >= 9 && hr < 5 {
                        log.Infof("success, inside of work hours!!")
                        return &v1beta1.CheckResult{
                            Status: status.OK,
                        }, nil
                    }
                    log.Infof("failure; outside of work hours!!")
                    return &v1beta1.CheckResult{
                        Status: status.WithPermissionDenied("Unauthorized..."),
                    }, nil
                }
                fmt.Println(claims["scope"])
            } else {
                fmt.Println(err)
            }
            log.Infof("success, as you're not a doctor!!")
            return &v1beta1.CheckResult{
                Status: status.OK,
            }, nil
        }
    }

Answer 1

您使用github.com/dgrijalva/jwt-go。是吗？

您使用未经验证的 ParseUnverified(https://godoc.org/github.com/dgrijalva/jwt-go#Parser.ParseUnverified)。

下面的代码是 ParseUnverified() 的例子。

package main

import (
    "fmt"

    "github.com/dgrijalva/jwt-go"
)

func main() {
    // This token is expired
    var tokenString = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJleHAiOjE1MDAwLCJpc3MiOiJ0ZXN0In0.HE7fK0xOQwFEr4WDgRWj4teRPZ6i3GLwD5YCm6Pwu_c"

    token, _, err := new(jwt.Parser).ParseUnverified(tokenString, jwt.MapClaims{})
    if err != nil {
        fmt.Println(err)
        return
    }

    if claims, ok := token.Claims.(jwt.MapClaims); ok {
        fmt.Println(claims["foo"], claims["exp"])
    } else {
        fmt.Println(err)
    }
}

ParseUnverified() 仅用于调试。

WARNING: Don't use this method unless you know what you're doing

This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it.

在没有验证的情况下解码 JWT 并找到范围

Decode JWT without validation and find scope

go

jwt

jwt-go