Examples with Token com.macasaet.fernet.Token used on opensource projects

Example 1 with Token

use of com.macasaet.fernet.Token in project fernet-java8 by l0s.

the class AuthenticationResource method createSession.

/**
 * This is an example of an endpoint that generates a new Fernet token. The
 * client authenticates using this method then can use the token provided to
 * perform secured operations. The client may, at their discretion, store
 * the token insecurely (e.g. in a cookie or browser storage) since it will
 * no longer be valid after the TTL (60 seconds by default).
 *
 * @param request
 *            client credentials to create a new session token
 * @return a Fernet token
 */
@POST
@Produces(MediaType.TEXT_PLAIN)
@Consumes(MediaType.APPLICATION_JSON)
public String createSession(final LoginRequest request) {
    final User user = repository.findUser(request.getUsername());
    if (user != null && user.isPasswordCorrect(request.getSingleRoundPasswordHash())) {
        // password is correct, so generate an ephemeral session
        // store the session ID in the token payload
        final Session session = new Session(request.getUsername());
        sessionRepository.saveSession(session);
        final Key key = keySupplier.get().iterator().next();
        final Token token = Token.generate(random, key, session.getId().toString());
        return token.serialise();
    }
    throw new NotAuthorizedException(Response.status(Status.UNAUTHORIZED).entity("invalid login").build());
}

Example 2 with Token

use of com.macasaet.fernet.Token in project fernet-java8 by l0s.

the class TokenInjectionIT method verifyFailedForgery.

/**
 * This demonstrates a client who attempts to forge a Fernet token but
 * cannot do so without knowing the secret key.
 */
@Test
public final void verifyFailedForgery() {
    // given
    final SecureRandom random = new SecureRandom();
    final Key invalidKey = Key.generateKey(random);
    final Token forgedToken = Token.generate(random, invalidKey, UUID.randomUUID().toString());
    final String tokenString = forgedToken.serialise();
    // when / then
    assertThrows(ForbiddenException.class, () -> target("secrets").request().header("Authorization", "Bearer\t" + tokenString).get(String.class));
}

Example 3 with Token

use of com.macasaet.fernet.Token in project fernet-java8 by l0s.

the class TokenHeaderUtilityTest method verifyGetAuthorizationTokenIgnoresX.

@Test
public final void verifyGetAuthorizationTokenIgnoresX() {
    // given
    final Key key = Key.generateKey(random);
    final Token token = Token.generate(random, key, "hello");
    final ContainerRequest request = mock(ContainerRequest.class);
    given(request.getHeaderString("X-Authorization")).willReturn(token.serialise());
    // when
    final Token result = utility.getAuthorizationToken(request);
    // then
    assertNull(result);
}

Example 4 with Token

use of com.macasaet.fernet.Token in project fernet-java8 by l0s.

the class ProtocolBuffersExampleIT method createSession.

/**
 * Start a new session.
 *
 * @return a serialised Fernet token with a {@link Session} embedded in the payload
 */
@POST
@Path("/api/sessions")
public String createSession(@Context final HttpServletResponse servletResponse) {
    final String sessionId = UUID.randomUUID().toString();
    final Builder builder = Session.newBuilder();
    builder.setSessionId(sessionId);
    builder.setRenewalCount(0);
    builder.setStartTime(Instant.now().getEpochSecond());
    servletResponse.addHeader("Location", "/api/sessions/" + sessionId);
    final Session session = builder.build();
    // persist session in server-side data store
    final Token token = Token.generate(random, key, session.toByteArray());
    return token.serialise();
}

Example 5 with Token

use of com.macasaet.fernet.Token in project fernet-java8 by l0s.

the class ProtectedResource method issueToken.

/**
 * @param username a valid username
 * @param password the password for the user <em>username</em>
 * @return a new Fernet token if and only if the credentials are valid
 * @throws NotAuthorizedException if invalid credentials are provided
 */
@POST
@Path("token")
public String issueToken(final String username, final String password) {
    if ("username".equals(username) && "password".equals(password)) {
        // might be nice to have Token.generate(repository, payload)
        final Key primaryKey = getKeyRepository().getPrimaryKey();
        final Token token = Token.generate(random, primaryKey, username);
        return token.serialise();
    }
    throw new NotAuthorizedException("Bearer realm=\"secrets\"");
}