java - 使用 jwt token 身份验证识别用户

Question

我使用 jersey Rest Web 服务以及带有 RSA 签名 token 功能的 JWT 进行身份验证。我能够成功创建 token 并将其发送到前端。现在，在我实现了这一点之后，我对验证 token 以及识别发出资源请求的用户感到困惑。

这里有几个问题:

1. 我是否必须解码前端收到的 jwt token 才能检查 claim ？
2. 如何识别在后端请求资源的用户？

因为在 SO 上的一些帖子中，有些人说不需要在前端解码 token ( check this link )，而其他网站上的其他示例显示了在前端解码 token 的示例，例如 this

现在我很困惑如何进一步确定是否应该在前端解码 token 还是保持原样？如果是这样，为什么其他示例会在前端显示解码，例如 this :

angular.module('app')
   .factory('Auth', ['$http', '$localStorage', 'urls', function ($http, $localStorage, urls) {
       function urlBase64Decode(str) {
           var output = str.replace('-', '+').replace('_', '/');
           switch (output.length % 4) {
               case 0:
                   break;
               case 2:
                   output += '==';
                   break;
               case 3:
                   output += '=';
                   break;
               default:
                   throw 'Illegal base64url string!';
           }
           return window.atob(output);
       }

       function getClaimsFromToken() {
           var token = $localStorage.token;
           var user = {};
           if (typeof token !== 'undefined') {
               var encoded = token.split('.')[1];
               user = JSON.parse(urlBase64Decode(encoded));
           }
           return user;
       }

我在这里使用的 token 示例:

private void authenticate(String email, String password)
    throws Exception {
try {
    Connection con = DBConnection.getConnection();
    PreparedStatement statement = con.prepareStatement("select USR_PRIMARY_EMAIL, USR_PASSWORD from TBL_USER where USR_PRIMARY_EMAIL=? and USR_PASSWORD=?");
    statement.setString(1, email);
    statement.setString(2, password);
    ResultSet result = statement.executeQuery();
    if (result.next()) {
        System.out.println("User authenticated successfully");

        KeyPairGenerator keyGenerator = KeyPairGenerator.getInstance("RSA");
        keyGenerator.initialize(1024);

        KeyPair kp = keyGenerator.genKeyPair();
        RSAPublicKey publicKey = (RSAPublicKey) kp.getPublic();
        RSAPrivateKey privateKey = (RSAPrivateKey) kp.getPrivate();
        JWSSigner signer = new RSASSASigner(privateKey);

        JWTClaimsSet claimsSet = new JWTClaimsSet();
        claimsSet.setSubject("alice");
        claimsSet.setIssuer("https://c2id.com");
        claimsSet.setExpirationTime(new Date(new Date().getTime() + 60 * 1000));

        System.out.println("publicKey is: " + publicKey);
        System.out.println("privateKey is: " + privateKey);
        System.out.println("claimsSet is: " + claimsSet);

        SignedJWT signedJWT = new SignedJWT(new JWSHeader(JWSAlgorithm.RS256),claimsSet);

        signedJWT.sign(signer);
        token = signedJWT.serialize();
        System.out.println("Token is: " + token);

        signedJWT = SignedJWT.parse(token);

        System.out.println("signedJWT is: " + signedJWT);

        JWSVerifier verifier = new RSASSAVerifier(publicKey);
        assertTrue(signedJWT.verify(verifier));
        assertEquals("alice", signedJWT.getJWTClaimsSet().getSubject());
        assertEquals("https://c2id.com", signedJWT.getJWTClaimsSet().getIssuer());
        assertTrue(new Date().before(signedJWT.getJWTClaimsSet().getExpirationTime()));
    } else {
        System.out.println("User doesn't exist");
    }
} catch (Exception e) {
    System.out.println("DB related Error");
    e.printStackTrace();
}
}

还有一个问题是使用 nimbus+jose_JWT(RSA 签名) 生成的 token 我无法以 Angular 解码 auth0图书馆。是因为我使用的是公钥吗？

Answer 1

Do I have to decode the jwt token received on front-end to check the claims?

是的。 JWT 声明集是 base64URL 编码的 JSON，因此您需要解码才能读取它。

<小时/>

How do I identify a user requesting for a resource on backend?

sub 声明是可选的，但实际上每个 JWT 提供商都会颁发带有标识请求者的主题 ID 的所有 token 。来自 JWT 规范:

The "sub" (subject) claim identifies the principal that is the subject of the JWT. The claims in a JWT are normally statements about the subject. The subject value MUST either be scoped to be locally unique in the context of the issuer or be globally unique. The processing of this claim is generally application specific. The "sub" value is a case-sensitive string containing a StringOrURI value. Use of this claim is OPTIONAL.

<小时/>

Also one more issue is the token generated using nimbus+jose_JWT(RSA signature) I am not able to decode in angular auth0 library. Is it because I am using public key?

没有。所有 JWT 声明集都是独立于签名方法的 base64URL 编码的 JSON，因此您应该能够对其进行解码。