Dominique.Fournier/DomFramework
1
0
Fork 0
Code Issues Pull Requests Projects Releases Activity

autjwt : manage correctely if the authentication is invalid with a reject

Browse Source 
git-svn-id: https://svn.fournier38.fr/svn/ProgSVN/trunk@5787 bf3deb0d-5f1a-0410-827f-c0cc1f45334c
This commit is contained in:
Dominique Fournier
2019-12-04 15:00:47 +00:00
parent a06c7464be
commit 2ddc3ad79c
1 changed files with 28 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
authjwt.php
View File

@@ -12,13 +12,25 @@ require_once ("domframework/jwt.php");
*/ */
class authjwt extends auth class authjwt extends auth
{ {
// PROPERTIES SET BY AUTH
/** The JSON Web Token Server key if used /** The JSON Web Token Server key if used
*/ */
public $serverKey = null; public $serverKey = null;
/** If the user is valid, return the email in details /** The cipher key to decrypt the token
*/ */
private $email = null; public $cipherKey = null;
/** The allowed algorithms in array format
* If null, all the algorithms are allowed
* allowed : ['HS256', 'HS512', 'HS384']
*/
public $allowedAlg = null;
// INTERNAL PROPERTIES
/** If the user is valid, return the payload in details
*/
private $payload = null;
/** Save the token /** Save the token
*/ */
@@ -44,23 +56,26 @@ class authjwt extends auth
throw new \Exception ("No Bearer Authentication available", 401); throw new \Exception ("No Bearer Authentication available", 401);
$token = substr ($_SERVER["HTTP_AUTHENTICATION"], 7); $token = substr ($_SERVER["HTTP_AUTHENTICATION"], 7);
$jwt = new jwt (); $jwt = new jwt ();
$payload = $jwt->decode ($token, $this->serverKey); $payload = $jwt->decode ($token, $this->serverKey, $this->allowedAlg,
if (! key_exists ("email", $payload)) $this->cipherKey);
return null;
// The JWT was tested in authparams. End of process // The JWT was tested in authparams. End of process
$this->email = $payload->email; if (! empty ($payload))
$this->token = substr ($_SERVER["HTTP_AUTHENTICATION"], 7); {
$this->payload = $payload;
$this->payload["bearer"] = substr ($_SERVER["HTTP_AUTHENTICATION"], 7);
}
if (! key_exists ("email", $this->payload))
throw new \Exception ("No email available in Bearer", 403);
} }
/** Return all the parameters recorded for the authenticate user */ /** Return all the parameters recorded for the authenticate user */
public function getdetails () public function getdetails ()
{ {
if ($this->email === null) if ($this->payload === null)
return array ("lastname" => "anonymous", return array ("lastname" => "anonymous",
"firstname" => "", "firstname" => "",
"email" => "anonymous"); "email" => "anonymous");
return array ("email" => $this->email, return $this->payload;
"bearer" => $this->token);
} }
/** Method to change the password : unavailable in SESSION auth /** Method to change the password : unavailable in SESSION auth
@@ -71,8 +86,7 @@ class authjwt extends auth
public function changepassword ($oldpassword, $newpassword) public function changepassword ($oldpassword, $newpassword)
{ {
throw new \Exception (dgettext ("domframework", throw new \Exception (dgettext ("domframework",
"The password can't be change for JWT users"), "The password can't be change for JWT users"), 405);
405);
} }
/** Method to overwrite the password (without oldpassword check) /** Method to overwrite the password (without oldpassword check)
@@ -84,15 +98,13 @@ class authjwt extends auth
public function overwritepassword ($email, $newpassword) public function overwritepassword ($email, $newpassword)
{ {
throw new \Exception (dgettext ("domframework", throw new \Exception (dgettext ("domframework",
"The password can't be overwrite for JWT users"), "The password can't be overwrite for JWT users"), 405);
405);
} }
/** Remove the information from the session */ /** Remove the information from the session */
public function logout () public function logout ()
{ {
throw new \Exception (dgettext ("domframework", throw new \Exception (dgettext ("domframework",
"The logout is not available for JWT users"), "The logout is not available for JWT users"), 405);
405);
} }
} }