Add token based authorization #90
Conversation
Signed-off-by: Santhosh Fernandes <[email protected]>
sanfern
force-pushed
the
sanfern-dev-auth-token
branch
from
37b0999 to
1eefbeb
Compare
|
|
||
| valid, statusCode := utils.ValidateToken(ctx, kfcfg.HostConfig, reqToken) | ||
| if !valid { | ||
| return |
There was a problem hiding this comment.
Shouldn't we set a status code above this indicating Unauthorized?
| "net/http" | ||
| "os" | ||
|
|
||
| jwt "github.com/dgrijalva/jwt-go" |
There was a problem hiding this comment.
This repo is no longer maintained, we should use the maintained one here:
https://github.com/golang-jwt/jwt
|
|
||
| var jwtSecretKey string | ||
| if conf.SecretsType == "ENV" { | ||
| jwtSecretKey = os.Getenv(conf.SecretsKey) |
There was a problem hiding this comment.
We probably should be clear and call this "SecreteKeyName" or something like that as it is not the actual key, but just the name of the secret key to retrieve
| } | ||
|
|
||
| token, err := jwt.Parse(reqToken, func(token *jwt.Token) (interface{}, error) { | ||
| return []byte(jwtSecretKey), nil |
There was a problem hiding this comment.
what about algorithm validation (SigningMethodHMAC)?
| return | ||
| } | ||
|
|
||
| valid, statusCode := utils.ValidateToken(ctx, kfcfg.HostConfig, reqToken) |
There was a problem hiding this comment.
What about moving jwt validation to chi and use protected routes? I think this would be better than implementing here. https://github.com/go-chi/jwtauth
|
|
||
| // secrets | ||
| SecretsKey string | ||
| SecretsType string |
There was a problem hiding this comment.
For supporting different secret stores it seems like the secrets package would provide more backend support. Otherwise we will have to keep implementing backends for different cloud platforms ourself.
https://pkg.go.dev/gocloud.dev/secrets
sanfern
force-pushed
the
sanfern-dev-auth-token
branch
from
1eefbeb to
3b10f32
Compare
Signed-off-by: Santhosh Fernandes <[email protected]>
sanfern
force-pushed
the
sanfern-dev-auth-token
branch
from
3b10f32 to
0b35c4b
Compare
Signed-off-by: Santhosh Fernandes [email protected]
It enables token-based authorization. Env variables or vaults can be used to store secrets.