From 849ac9410c4e03a425a417c812f33d0105e595b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Toma=C5=BE=20Jerman?= Date: Fri, 4 Feb 2022 13:45:25 +0100 Subject: [PATCH] Use custom token middleware to use JWT via query params --- pkg/auth/token_middleware.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkg/auth/token_middleware.go b/pkg/auth/token_middleware.go index b9ed6d11c..a0a1a4004 100644 --- a/pkg/auth/token_middleware.go +++ b/pkg/auth/token_middleware.go @@ -16,6 +16,14 @@ var ( HttpTokenVerifier func(http.Handler) http.Handler ) +// verifier is a custom middleware as the built-in one does not look at query parameters +// and it instructs to build one yourself +func verifier(ja *jwtauth.JWTAuth) func(http.Handler) http.Handler { + return func(next http.Handler) http.Handler { + return jwtauth.Verify(ja, jwtauth.TokenFromHeader, jwtauth.TokenFromQuery, jwtauth.TokenFromCookie)(next) + } +} + // TokenVerifierMiddlewareWithSecretSigner returns HTTP handler with simple jwa.HS512 + secret verifier // // This should be 1:1 with token issuer! @@ -29,7 +37,7 @@ func TokenVerifierMiddlewareWithSecretSigner(secret string) (_ func(http.Handler return nil, fmt.Errorf("could not parse JWK: %w", err) } - return jwtauth.Verifier(jwtauth.New(jwa.HS512.String(), key, nil)), nil + return verifier(jwtauth.New(jwa.HS512.String(), key, nil)), nil } // HttpTokenValidator checks if there is a token with identity and matching scope claim