Akka-CQRS（15）- Http标准安全解决方案：OAuth2+JWT

上期讨论过OAuth2, 是一种身份认证+资源授权使用模式。通过身份认证后发放授权凭证。用户凭授权凭证调用资源。这个凭证就是一种令牌，基本上是一段没什么意义的加密文，或者理解成密钥也可以。服务方通过这个令牌来获取用户身份信息，也就是说服务端必须维护一个已经获得身份验证的用户信息清单。研究了一下JWT，发现它本身可以携带加密后的一些信息包括用户信息，而这些信息又可以通过同样的加密算法解密恢复。也就是说服务端是可以直接对收到的JWT解密恢复用户信息，这样用起来就方便多了。还记着我们的POS例子里客户端必须构建一个指令，如：http://www.pos.com/logIn?shopid=1001&userid=234 这个Uri里的shopid是明码的，会造成很大安全风险。使用JWT后，我们可以把shopid，单号什么的都放在JWT里就安全多了。

先了解一下JWT：JWT也是一个行业标准：RFC7519，是一个用Json格式传递加密信息的方式。JWT的结构如下：

header.payload.signiture 如：hhhhh.ppppp.ssssss

header：由两部分组成：1、令牌类型，在这里是JWT, 2、签名算法如 HMAC SHA256 or RSA，下面是个header例子：

{

  "alg": "HS256",

  "typ": "JWT"

}

payload：可以用来承载用户自定义信息，如userid, shopid, vchnum ...

{

  "shopid": "",

  "userid": "",

  "vchnum":

}

signiture: 就是把加密后的header+加密后的payload+secret 用header提供的签名算法签名，如下：

HMACSHA256(

  base64UrlEncode(header) + "." +

  base64UrlEncode(payload),

  secret)

我的目标是把一些用来辨识用户、权限以及状态信息加密存在JWT内发送给用户，用户在请求中提交他的JWT，服务端再解密并取出内部信息然后确定如何处理用户请求。

JWT本身原理并不复杂，应用场景也不是很多，所以不想花太多精力研究它。刚好，找到一个开源的scala JWT工具库jwt-scala. 下面就利用项目源代码来了解一下JWT的操作，包括：加密、解密、验证、获取payload内部claims值。

JWT encode 方法如下：

  /** Encode a JSON Web Token from its different parts. Both the header and the claim will be encoded to Base64 url-safe, then a signature will be eventually generated from it if you did pass a key and an algorithm, and finally, those three parts will be merged as a single string, using dots as separator.

    *

    * @return $token

    * @param header $headerString

    * @param claim $claimString

    * @param key $key

    * @param algorithm $algo

    */

  def encode(header: String, claim: String, key: String, algorithm: JwtAlgorithm): String = {

    val data = JwtBase64.encodeString(header) + "." + JwtBase64.encodeString(claim)

    data + "." + JwtBase64.encodeString(JwtUtils.sign(data, key, algorithm))

  }

所以产生JWT的元素都在参数里了。我们可以直接用payload.claims来构建JWT：

 /** An alias to `encode` which will provide an automatically generated header.

    *

    * @return $token

    * @param claim $claimString

    */

  def encode(claim: String): String = encode(JwtHeader().toJson, claim)

  /** An alias to `encode` which will provide an automatically generated header and setting both key and algorithm

    * to None.

    *

    * @return $token

    * @param claim the claim of the JSON Web Token

    */

  def encode(claim: JwtClaim): String = encode(claim.toJson)

 def encode(header: String, claim: String): String = {

    JwtBase64.encodeString(header) + "." + JwtBase64.encodeString(claim) + "."

  }

这样看一个正确的JWT可以没有签名那部分的：hhhhh.ppppp。想想还是要用签名，安全点。用下面这个函数就可以了：

  /** An alias to `encode` which will provide an automatically generated header and allowing you to get rid of Option

    * for the key and the algorithm.

    *

    * @return $token

    * @param claim $claimString

    * @param key $key

    * @param algorithm $algo

    */

  def encode(claim: String, key: String, algorithm: JwtAlgorithm): String =

    encode(JwtHeader(algorithm).toJson, claim, key, algorithm)

/** Deserialize an algorithm from its string equivalent. Only real algorithms supported,

    * if you need to support "none", use "optionFromString".

    *

    * @return the actual instance of the algorithm

    * @param algo the name of the algorithm (e.g. HS256 or HmacSHA256)

    * @throws JwtNonSupportedAlgorithm in case the string doesn't match any known algorithm

    */

  def fromString(algo: String): JwtAlgorithm = algo match {

    case "HMD5"        => HMD5

    case "HS224"       => HS224

    case "HS256"       => HS256

    case "HS384"       => HS384

    case "HS512"       => HS512

    case "RS256"       => RS256

    case "RS384"       => RS384

    case "RS512"       => RS512

    case "ES256"       => ES256

    case "ES384"       => ES384

    case "ES512"       => ES512

    case _             => throw new JwtNonSupportedAlgorithm(algo)

    // Missing PS256 PS384 PS512

  }

key可以是任意字符串。

JWT decode 代码如下：

  /** Will try to decode a JSON Web Token to raw strings using a HMAC algorithm

    *

    * @return if successful, a tuple of 3 strings, the header, the claim and the signature

    * @param token $token

    * @param key $key

    * @param algorithms $algos

    */

  def decodeRawAll(token: String, key: String, algorithms: Seq[JwtHmacAlgorithm], options: JwtOptions): Try[(String, String, String)] = Try {

    val (header64, header, claim64, claim, signature) = splitToken(token)

    validate(header64, parseHeader(header), claim64, parseClaim(claim), signature, key, algorithms, options)

    (header, claim, signature)

  }

  def decodeRawAll(token: String, key: String, algorithms: Seq[JwtHmacAlgorithm]): Try[(String, String, String)] =

    decodeRawAll(token, key, algorithms, JwtOptions.DEFAULT)

另外，验证JWT方法如下：

  /** An alias for `isValid` if you want to directly pass a string as the key for HMAC algorithms

    *

    * @return a boolean value indicating if the token is valid or not

    * @param token $token

    * @param key $key

    * @param algorithms $algos

    */

  def isValid(token: String, key: String, algorithms: Seq[JwtHmacAlgorithm], options: JwtOptions): Boolean =

    try {

      validate(token, key, algorithms, options)

      true

    } catch {

      case _ : Throwable => false

    }

  def isValid(token: String, key: String, algorithms: Seq[JwtHmacAlgorithm]): Boolean = isValid(token, key, algorithms, JwtOptions.DEFAULT)

下面是一段示范代码：

import pdi.jwt._

import org.json4s._

import org.json4s.jackson.JsonMethods._

object JwtDemo extends App{

  import scala.util._

  var clms = JwtClaim() ++ ("shopid" -> "") ++ ("userid" -> "") ++ ("vchnum" -> )

  val token = Jwt.encode(clms,"OpenSesame", JwtAlgorithm.HS256)

  println(token)

  println(Jwt.isValid(token,"OpenSesame",Seq(JwtAlgorithm.HS256)))

  val claims = Jwt.decodeRawAll(token,"OpenSesame",Seq(JwtAlgorithm.HS256))

  println(claims)

  claims match {

    case Success(json) => println(((parse(json._2).asInstanceOf[JObject]) \ "shopid").values)

    case Failure(err) => println(s"Error: ${err.getMessage}")

  }

}

现在我们把上次的OAuth2示范代码改改，用JWT替换access_token：

import akka.actor._

import akka.stream._

import akka.http.scaladsl.Http

import akka.http.scaladsl.server.Directives._

import akka.http.scaladsl.server.directives.Credentials

import pdi.jwt._

import org.json4s._

import org.json4s.jackson.JsonMethods._

import scala.util._

//import akka.http.scaladsl.marshallers.sprayjson._

//import spray.json._

object JsonMarshaller { // extends  SprayJsonSupport with DefaultJsonProtocol {

  case class UserInfo(username: String, password: String, appInfo: (String,String))

  /* 用JWT替代

  case class AuthToken(access_token: String = java.util.UUID.randomUUID().toString,

                        token_type: String = "bearer",

                        expires_in: Int = 3600)

  */

  /* 无需维护这个验证后用户清单了

  case class AuthUser(credentials: UserInfo,

                      token: AuthToken = new AuthToken(expires_in = 60 * 60 * 8),

                          loggedInAt: String = LocalDateTime.now().toString)

   val loggedInUsers = mutable.ArrayBuffer.empty[AuthUser]

   */

  val validUsers = Seq(UserInfo("johnny", "p4ssw0rd",("", ""))

                       ,UserInfo("tiger", "secret", ("" , "")))

  def getValidUser(credentials: Credentials): Option[UserInfo] =

    credentials match {

      case p @ Credentials.Provided(_) =>

        validUsers.find(user => user.username == p.identifier && p.verify(user.password))

      case _ => None

    }

   /*收到的是JWT

   def authenticateUser(credentials: Credentials): Option[(String,String)] =

    credentials match {

      case p @ Credentials.Provided(_) =>

        loggedInUsers.find(user => p.verify(user.token.access_token))

      case _ => None

    } */

  def authenticateJwt(credentials: Credentials): Option[String] =

    credentials match {

      case Credentials.Provided(token) =>

        Jwt.isValid(token,"OpenSesame",Seq(JwtAlgorithm.HS256)) match {

          case true => Some(token)

          case _ => None

        }

      case _ => None

    }

/*

  implicit val fmtCredentials = jsonFormat2(UserInfo.apply)

  implicit val fmtToken = jsonFormat3(AuthToken.apply)

  implicit val fmtUser = jsonFormat3(AuthUser.apply)

 */

}

object Oauth2ServerDemo extends App {

  implicit val httpSys = ActorSystem("httpSystem")

  implicit val httpMat = ActorMaterializer()

  implicit val httpEC = httpSys.dispatcher

  import JsonMarshaller._

  val route =

    pathEndOrSingleSlash {

      get {

        complete("Welcome!")

      }

    } ~

      path("auth") {

        authenticateBasic(realm = "auth", getValidUser) { user =>

          post {

            val claims = JwtClaim() + ("appInfo" , (user.appInfo._1,user.appInfo._2))

            complete(Jwt.encode(claims,"OpenSesame",JwtAlgorithm.HS256))

          }

        }

      } ~

      path("api") {

        authenticateOAuth2(realm = "api", authenticateJwt) { validToken =>

          val pi = Jwt.decodeRawAll(validToken,"OpenSesame",Seq(JwtAlgorithm.HS256)) match {

            case Success(parts) => Some(((parse(parts._2).asInstanceOf[JObject]) \ "appInfo").values.asInstanceOf[Map[String,String]].toList.head)

            case Failure(_) => None

          }

          complete(s"It worked! token = $validToken, appInfo = ${pi}")

        }

      }

  val (port, host) = (,"192.168.11.189")

  val bindingFuture = Http().bindAndHandle(route,host,port)

  println(s"Server running at $host $port. Press any key to exit ...")

  scala.io.StdIn.readLine()

  bindingFuture.flatMap(_.unbind())

    .onComplete(_ => httpSys.terminate())

}

下面是客户端测试代码：

import akka.actor._

import akka.stream._

import akka.http.scaladsl.Http

import akka.http.scaladsl.model.headers._

import scala.concurrent._

import akka.http.scaladsl.model._

import pdi.jwt._

import org.json4s._

import org.json4s.jackson.JsonMethods._

import scala.util._

import scala.concurrent.duration._

object Oauth2Client  {

    def main(args: Array[String]): Unit = {

      implicit val system = ActorSystem()

      implicit val materializer = ActorMaterializer()

      // needed for the future flatMap/onComplete in the end

      implicit val executionContext = system.dispatcher

      val helloRequest = HttpRequest(uri = "http://192.168.11.189:50081/")

      val authorization = headers.Authorization(BasicHttpCredentials("johnny", "p4ssw0rd"))

      val authRequest = HttpRequest(

        HttpMethods.POST,

        uri = "http://192.168.11.189:50081/auth",

        headers = List(authorization)

      )

      val futToken: Future[HttpResponse] = Http().singleRequest(authRequest)

      val respToken = for {

        resp <- futToken

        jstr <- resp.entity.dataBytes.runFold("") {(s,b) => s + b.utf8String}

      } yield jstr

      val jstr =  Await.result[String](respToken, seconds)

      println(jstr)

      scala.io.StdIn.readLine()

      val parts = Jwt.decodeRawAll(jstr, "OpenSesame", Seq(JwtAlgorithm.HS256)) match {

        case Failure(exception) => println(s"Error: ${exception.getMessage}")

        case Success(value) =>

          val tt: (String,String) = ((parse(value._2).asInstanceOf[JObject]) \ "appInfo").values.asInstanceOf[Map[String,String]].toList.head

          println(tt)

      }

      scala.io.StdIn.readLine()

      val authentication = headers.Authorization(OAuth2BearerToken(jstr))

      val apiRequest = HttpRequest(

        HttpMethods.POST,

        uri = "http://192.168.11.189:50081/api",

      ).addHeader(authentication)

      val futAuth: Future[HttpResponse] = Http().singleRequest(apiRequest)

      println(Await.result(futAuth, seconds))

      scala.io.StdIn.readLine()

      system.terminate()

    }

  }

运行后输出结果：

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBJbmZvIjp7IjExMDEiOiIxMDEifX0.i46FUinT0n1brYGInFZz-6embOj15SKpIpO9QHkpSZs

(,)

HttpResponse( OK,List(Server: akka-http/10.1., Date: Tue,  Jul  :: GMT),HttpEntity.Strict(text/plain; charset=UTF-,It worked! token = eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBJbmZvIjp7IjExMDEiOiIxMDEifX0.i46FUinT0n1brYGInFZz-6embOj15SKpIpO9QHkpSZs, appInfo = Some((,))),HttpProtocol(HTTP/1.1))

Process finished with exit code  (interrupted by signal : SIGINT)

构建环境 build.sbt:

name := "oauth2"

version := "0.1"

scalaVersion := "2.12.8"

libraryDependencies ++= Seq(

  "com.typesafe.akka" %% "akka-http"   % "10.1.8",

  "com.typesafe.akka" %% "akka-stream" % "2.5.23",

  "com.pauldijou" %% "jwt-core" % "3.0.1",

  "de.heikoseeberger" %% "akka-http-json4s" % "1.22.0",

  "org.json4s" %% "json4s-native" % "3.6.1",

  "com.typesafe.akka" %% "akka-http-spray-json" % "10.1.8",

  "com.typesafe.scala-logging" %% "scala-logging" % "3.9.0",

  "org.slf4j" % "slf4j-simple" % "1.7.25",

  "org.json4s" %% "json4s-jackson" % "3.6.7"

)

巴特西

Akka-CQRS（15）- Http标准安全解决方案：OAuth2+JWT

最新文章

热门文章