Function JwtHandler

auth/jwt.go:20–83

JwtHandler is a middleware that checks for a JWT token in the cookie or the authorization header. If the token is found, it is validated and the claims

(ac Auth)

// JwtHandler is a middleware that checks for a JWT token in the cookie or the
// authorization header. If the token is found, it is validated and the claims
func JwtHandler(ac Auth) (HandlerFunc, error) {
	jwtProvider, err := provider.NewProvider(ac.JWT)
	if err != nil {
		return nil, err
	}

	cookie := ac.Cookie

	return func(w http.ResponseWriter, r *http.Request) (context.Context, error) {
		var tok string

		if cookie != "" {
			if ck, err := r.Cookie(cookie); err == nil && len(ck.Value) != 0 {
				tok = ck.Value
			}
		}

		if tok == "" {
			if ah := r.Header.Get(authHeader); len(ah) > 7 && strings.HasPrefix(ah, "Bearer ") {
				tok = ah[7:]
			}
		}

		if tok == "" {
			return nil, fmt.Errorf("no jwt token found in cookie or authorization header")
		}

		keyFunc := jwtProvider.KeyFunc()
		token, err := jwt.ParseWithClaims(tok, jwt.MapClaims{}, keyFunc) // jwt.MapClaims is already passed by reference
		if err != nil {
			return nil, err
		}

		if claims, ok := token.Claims.(jwt.MapClaims); ok {
			ctx := r.Context()

			if !jwtProvider.VerifyAudience(claims) {
				return nil, fmt.Errorf("invalid aud claim")
			}

			if !jwtProvider.VerifyIssuer(claims) {
				return nil, fmt.Errorf("invalid iss claim")
			}

			ctx, err = jwtProvider.SetContextValues(ctx, claims)
			if err != nil {
				return ctx, err
			}

			// Attach optional identity claims for audit logging. These are
			// strictly informational — the role / authorization decision is
			// driven by sub / role.
			if email, ok := claims["email"].(string); ok && email != "" {
				ctx = context.WithValue(ctx, userEmailKey, email)
			}
			if name, ok := claims["name"].(string); ok && name != "" {
				ctx = context.WithValue(ctx, userNameKey, name)
			}