Documentation
¶
Index ¶
- Constants
- Variables
- func AesGcmDecryptBin(encryptedBytes []byte) ([]byte, error)
- func AesGcmDecryptHex(encryptedString string) (string, error)
- func AesGcmEncryptBin(plaintext []byte) ([]byte, error)
- func AesGcmEncryptHex(plaintext string) (string, error)
- func B64Decode(b64 []byte, reuse bool) ([]byte, error)
- func DecryptVerificationKeyDER(algo string, accessKey []byte) ([]byte, error)
- func GenAccessToken(timeout, maxTTL, user string, groups, orgs []string, secretKey []byte) (string, error)
- func GenAccessTokenWithAlgo(algo, timeout, maxTTL, user string, groups, orgs []string, keyDER []byte) (string, error)
- func GenRefreshToken(timeout, maxTTL, namespace, user string, secretKey []byte) (string, error)
- func GenerateEdDSAKey() []byte
- func GenerateKeyECDSA(c elliptic.Curve) []byte
- func GenerateKeyHMAC(bits int) []byte
- func GenerateKeyRSA(bits int) []byte
- func GenerateSigningKey(algo string) ([]byte, error)
- func GenerateSigningKeyHex(algo string) (string, error)
- func NewAccessToken(maxTTL, user string, groups, orgs []string, hexKey string) string
- func NewCookie(tokenizer Tokenizer, name, plan, user string, secure bool, dns, dir string) http.Cookie
- func ParsePublicDER(algo string, der []byte) (any, error)
- func PrivateDER2Public(algo string, der []byte) (any, error)
- func PrivateDER2PublicDER(algo string, privateDER []byte) ([]byte, error)
- func SplitThreeParts(jwt []byte) (p1, p2 int, _ error)
- func ValidAccessToken(accessToken, algo string, verificationKeyDER []byte) error
- type AccessClaims
- type Base
- type BytesKey
- type ECDSA
- type ES256
- type ES384
- type ES512
- type EdDSA
- type HS256
- type HS384
- type HS512
- type JWTChecker
- func (ck *JWTChecker) Chk(next http.Handler) http.Handler
- func (ck *JWTChecker) Cookie(i int) *http.Cookie
- func (ck *JWTChecker) PermFromBearerOrCookie(r *http.Request) (perm Perm, err []any)
- func (ck *JWTChecker) PermFromCookie(r *http.Request) (perm Perm, err []any)
- func (ck *JWTChecker) PermFromJWT(jwt string) (Perm, []any)
- func (ck *JWTChecker) Set(next http.Handler) http.Handler
- func (ck *JWTChecker) Vet(next http.Handler) http.Handler
- type Perm
- type RefreshClaims
- type Tokenizer
- type Verifier
Constants ¶
const ( DefaultCookieName = "g" // g as in garcon // DefaultPlan is the plan name in absence of "permissions" parametric parameters. DefaultPlan = "VIP" // DefaultPerm is the perm value in absence of "permissions" parametric parameters. DefaultPerm = 1 )
Variables ¶
var ( ErrColumnInKey = errors.New("found a column symbol in the key string but NemHMAC() does not support AlgoKey scheme => use NewVerifier(algoKey)") ErrECDSAPubKey = errors.New("cannot parse the DER bytes as a valid ECDSA public key") ErrEdDSAPubKey = errors.New("cannot decode the EdDSA public key, please provide 88 hexadecimal digits or a Base64 string containing about 59 characters") ErrES256PubKey = errors.New("cannot decode the ECDSA-P256-SHA256 public key, please provide 182 hexadecimal digits or a Base64 string containing about 122 characters") ErrES384PubKey = errors.New("cannot decode the ECDSA-P384-SHA384 public key, please provide 240 hexadecimal digits or a Base64 string containing 160 characters") ErrES512PubKey = errors.New("cannot decode the ECDSA-P512-SHA512 public key, please provide 316 hexadecimal digits or a Base64 string containing about 211 characters") ErrExpiredToken = errors.New("expired or invalid access token") ErrHMACKey = errors.New("cannot decode the HMAC key, please provide a key in hexadecimal or Base64 form (64, 96 or 128 hexadecimal digits ; 43, 64 or 86 Base64 characters)") ErrHS256PubKey = errors.New("cannot decode the HMAC-SHA256 key, please provide 64 hexadecimal digits or a Base64 string containing about 43 characters") ErrHS384PubKey = errors.New("cannot decode the HMAC-SHA384 key, please provide 96 hexadecimal digits or a Base64 string containing 64 characters") ErrHS512PubKey = errors.New("cannot decode the HMAC-SHA512 key, please provide 128 hexadecimal digits or a Base64 string containing about 86 characters") ErrJWTSignature = errors.New("JWT signature mismatch") ErrNoAuthorization = errors.New("provide your JWT within the 'Authorization Bearer' HTTP header") ErrNoBase64JWT = errors.New("the token claims (second part of the JWT) is not base64-valid") ErrNoBearer = errors.New("malformed HTTP Authorization, must be Bearer") ErrNoValidJWT = errors.New("cannot find a valid JWT in either the cookie or the first 'Authorization' HTTP header") ErrThreeParts = errors.New("JWT must be composed of three parts separated by periods") )
var EncodingKey []byte
EncodingKey is used to encode each JWT secret key in the DB.
Functions ¶
func AesGcmDecryptBin ¶
func AesGcmDecryptHex ¶
AesGcmDecryptHex : decrypt content.
func AesGcmEncryptBin ¶
AesGcmEncryptBin : encrypt content.
func AesGcmEncryptHex ¶
AesGcmEncryptHex : encrypt content.
func B64Decode ¶
B64Decode avoid allocating memory when reuse=true by reusing the input buffer to return the base64-decoded result.
func DecryptVerificationKeyDER ¶
DecryptVerificationKeyDER returns the secret key for symmetric algos (like HMAC), or the public key for asymmetric algos (like RSA, EdDSA). The returned key is in DER format.
func GenAccessToken ¶
func GenAccessToken(timeout, maxTTL, user string, groups, orgs []string, secretKey []byte) (string, error)
GenAccessToken generates an access token with HS256 signing algo. Deprecated: Use `GenAccessTokenWithAlgo("HMAC", ...)`.
func GenAccessTokenWithAlgo ¶
func GenAccessTokenWithAlgo(algo, timeout, maxTTL, user string, groups, orgs []string, keyDER []byte) (string, error)
GenAccessTokenWithAlgo creates an Access Token with the JSON fields "exp", "usr", "grp" and "org".
func GenRefreshToken ¶
GenRefreshToken generates a refresh token for a user in a namespace.
func GenerateEdDSAKey ¶
func GenerateEdDSAKey() []byte
GenerateEdDSAKey generates a random EdDSA-25519 key in DER format.
func GenerateKeyECDSA ¶
GenerateKeyECDSA generates a random ECDSA private key in DER format.
func GenerateKeyHMAC ¶
GenerateKeyHMAC generates a random HMAC-SHA256 key.
func GenerateKeyRSA ¶
GenerateKeyRSA generates a random RSA private key in DER format.
func GenerateSigningKey ¶
GenerateSigningKey produces the private key of the given algorithm. Supported algorithms:
- HS256 = HMAC using SHA-256 - HS384 = HMAC using SHA-384 - HS512 = HMAC using SHA-512 - RS256 = RSASSA-PKCS-v1.5 using SHA-256 - RS384 = RSASSA-PKCS-v1.5 using SHA-384 - RS512 = RSASSA-PKCS-v1.5 using SHA-512 - ES256 = ECDSA using P-256 and SHA-256 - ES384 = ECDSA using P-384 and SHA-384 - ES512 = ECDSA using P-521 and SHA-512 - EdDSA = Ed25519.
func GenerateSigningKeyHex ¶
GenerateSigningKeyHex produces the private key in hexadecimal form.
func NewAccessToken ¶
func ParsePublicDER ¶
ParsePublicDER converts a public key in DER form into the original public key.
func PrivateDER2Public ¶
PrivateDER2Public converts a private key into a public key depending on the algo.
func PrivateDER2PublicDER ¶
PrivateDER2PublicDER converts a private key into a public key depending on the algo. The input and output are in DER form.
func SplitThreeParts ¶
SplitThreeParts returns the period position decompose the JWT in three parts.
func ValidAccessToken ¶
Types ¶
type AccessClaims ¶
type AccessClaims struct {
jwt.RegisteredClaims
Username string `json:"usr,omitempty"`
Groups []string `json:"grp,omitempty"`
Orgs []string `json:"org,omitempty"`
}
AccessClaims is the standard claims for a user access token.
func AccessClaimsFromBase64 ¶
func AccessClaimsFromBase64(payload []byte, reuse bool) (*AccessClaims, error)
type HS256 ¶
type HS256 struct{ BytesKey }
func (*HS256) GenAccessToken ¶
type JWTChecker ¶
type JWTChecker struct {
// contains filtered or unexported fields
}
func NewJWTChecker ¶
func NewJWTChecker(writer gg.Writer, urls []*url.URL, keyTxt, cookieName string, permissions ...any) *JWTChecker
NewJWTChecker supports keyTxt in hexadecimal and Base64 form Moreover the keyTxt parameter can also be prefixed by the signing algorithm. The keyTxt scheme is: `alg:xxxxxxxxxxxxxxxxxxxxxxxxxx` where `alg` is the optional algorithm name, and `xxxxxxxxxxxxxxxxxxxxxxxxxx` is the key encoded in either hexadecimal or unpadded Base64 as defined in RFC 4648 §5 (URL encoding).
func (*JWTChecker) Chk ¶
func (ck *JWTChecker) Chk(next http.Handler) http.Handler
Chk is a middleware to accept only HTTP requests having a valid cookie. Then, Chk puts the permission (of the JWT) in the request context.
func (*JWTChecker) Cookie ¶
func (ck *JWTChecker) Cookie(i int) *http.Cookie
Cookie returns a default cookie to facilitate testing.
func (*JWTChecker) PermFromBearerOrCookie ¶
func (ck *JWTChecker) PermFromBearerOrCookie(r *http.Request) (perm Perm, err []any)
func (*JWTChecker) PermFromCookie ¶
func (ck *JWTChecker) PermFromCookie(r *http.Request) (perm Perm, err []any)
func (*JWTChecker) PermFromJWT ¶
func (ck *JWTChecker) PermFromJWT(jwt string) (Perm, []any)
func (*JWTChecker) Set ¶
func (ck *JWTChecker) Set(next http.Handler) http.Handler
Set is a middleware putting a HttpOnly cookie in the HTTP response header when no valid cookie is present. The new cookie conveys the JWT of the first plan. Set also puts the permission from the JWT in the request context.
type Perm ¶
type Perm struct {
Value int
}
func PermFromCtx ¶
PermFromCtx gets the permission information from the request context.
type RefreshClaims ¶
type RefreshClaims struct {
jwt.RegisteredClaims
Namespace string `json:"namespace,omitempty"`
Username string `json:"username,omitempty"`
}
RefreshClaims is the standard claims for a user refresh token.
type Tokenizer ¶
type Verifier ¶
type Verifier interface {
Claims(accessToken []byte) (*AccessClaims, error)
Verify(headerPayload, signature []byte) bool
Reuse() bool
}
func NewVerifier ¶
NewVerifier creates a new Verifier to speed up the verification of many Access Tokens with the same verification key.
The parameter algoKey accepts three different schemes:
only a HMAC secret key: algoKey = "9d2e0a02121179a3c3de1b035ae1355b1548781c8ce8538a1dc0853a12dfb13d"
both the signing algo and its verification key: algoKey = "HS256:9d2e0a02121179a3c3de1b035ae1355b1548781c8ce8538a1dc0853a12dfb13d"
the Quid URL to fetch the algo/key info from a given namespace algoKey = "https://lynxai.eu/quid/v1?ns=foobar"
In the two first forms, NewVerifier accepts the key to be in hexadecimal, or in Base64 form. NewVerifier converts the verification key into binary DER form depending on the key string length and the optional algo name. The algo name is case insensitive.
Source Files