| 123 | |
| 124 | |
| 125 | Try<JSON::Object> parse_payload(const string& component) |
| 126 | { |
| 127 | Try<JSON::Object> payload = decode(component); |
| 128 | |
| 129 | if (payload.isError()) { |
| 130 | return Error("Failed to decode token payload: " + payload.error()); |
| 131 | } |
| 132 | |
| 133 | // Validate standard claims. |
| 134 | |
| 135 | const Result<JSON::Value> exp_json = payload->find<JSON::Value>("exp"); |
| 136 | |
| 137 | if (exp_json.isError()) { |
| 138 | return Error( |
| 139 | "Error when extracting 'exp' field from token JSON payload: " + |
| 140 | exp_json.error()); |
| 141 | } |
| 142 | |
| 143 | if (exp_json.isSome()) { |
| 144 | if (!exp_json->is<JSON::Number>()) { |
| 145 | return Error("JSON payload 'exp' field is not a number"); |
| 146 | } |
| 147 | |
| 148 | const int64_t exp = exp_json->as<JSON::Number>().as<int64_t>(); |
| 149 | const int64_t now = Clock::now().secs(); |
| 150 | |
| 151 | if (exp < now) { |
| 152 | return Error( |
| 153 | "Token has expired: exp(" + |
| 154 | stringify(exp) + ") < now(" + stringify(now) + ")"); |
| 155 | } |
| 156 | } |
| 157 | |
| 158 | // TODO(nfnt): Validate other standard claims. |
| 159 | return payload; |
| 160 | } |
| 161 | |
| 162 | |
| 163 | // Implements equality between strings which run in constant time by either |