| | | 1 | | using ArturRios.Jwt; |
| | | 2 | | using ArturRios.Util.WebApi.Security.Authentication; |
| | | 3 | | using ArturRios.Util.WebApi.Security.Interfaces; |
| | | 4 | | using ArturRios.Util.WebApi.Security.Records; |
| | | 5 | | |
| | | 6 | | namespace ArturRios.Heimdall.WebApi.Security; |
| | | 7 | | |
| | | 8 | | /// <summary> |
| | | 9 | | /// The bearer-token validator <c>AuthenticationMiddleware</c> runs: the library's |
| | | 10 | | /// <see cref="JwtTokenValidator" />, which checks the ES256 signature and lifetime and maps the |
| | | 11 | | /// claims, followed by the issuer and audience check it does not make (<see cref="TokenOrigin" />). |
| | | 12 | | /// </summary> |
| | | 13 | | /// <remarks> |
| | | 14 | | /// <para> |
| | | 15 | | /// A token passes only under the configured issuer and one of the three person audiences |
| | | 16 | | /// (<see cref="PersonTokenAudiences" />). The challenge audience is among them so that |
| | | 17 | | /// <see cref="MfaPendingGuardFilter" /> still answers a challenge used as a bearer token with |
| | | 18 | | /// its own refusal; the application audience is not, since an application token is never a |
| | | 19 | | /// person (TH-35). |
| | | 20 | | /// </para> |
| | | 21 | | /// <para> |
| | | 22 | | /// An HS256 token is refused like any other bad signature: the configuration pins ES256 and |
| | | 23 | | /// holds EC keys alone, and the shared secret Heimdall once signed with is no longer read |
| | | 24 | | /// (Threat Model TH-43). |
| | | 25 | | /// </para> |
| | | 26 | | /// <para> |
| | | 27 | | /// A token refused here gets the answer a bad signature gets, so a correctly signed token for |
| | | 28 | | /// another service cannot be told apart from a forged one. |
| | | 29 | | /// </para> |
| | | 30 | | /// </remarks> |
| | 1061 | 31 | | public sealed class PersonTokenValidator( |
| | 1061 | 32 | | JwtTokenValidator inner, |
| | 1061 | 33 | | JwtConfiguration configuration, |
| | 1061 | 34 | | PersonTokenAudiences audiences) : ITokenValidator |
| | | 35 | | { |
| | | 36 | | /// <summary>The error <see cref="JwtTokenValidator" /> gives a token whose signature or lifetime fails.</summary> |
| | | 37 | | public const string InvalidToken = "Invalid token"; |
| | | 38 | | |
| | | 39 | | /// <inheritdoc /> |
| | | 40 | | public async Task<TokenValidationResult> ValidateAsync(string token, HttpContext context) |
| | | 41 | | { |
| | 1094 | 42 | | var result = await inner.ValidateAsync(token, context); |
| | | 43 | | |
| | 1094 | 44 | | if (result.User is null) |
| | | 45 | | { |
| | 115 | 46 | | return result; |
| | | 47 | | } |
| | | 48 | | |
| | 979 | 49 | | return TokenOrigin.IsIssuedFor( |
| | 979 | 50 | | token, configuration.Issuer, audiences.Person, audiences.TwoFactorChallenge, audiences.SubjectRights) |
| | 979 | 51 | | ? result |
| | 979 | 52 | | : new TokenValidationResult(null, InvalidToken); |
| | 1094 | 53 | | } |
| | | 54 | | } |