設(shè)置：React 前端和 Golang 后端。我的 React 前端成功從 Google 獲取令牌：<GoogleLogin clientId="<client-id>.apps.googleusercontent.com" onSuccess={response => responseGoogle(response)}></GoogleLogin>我有一個突變可以發(fā)送我需要的信息：initiateTestMutation({ variables: { idToken: response.getAuthResponse().id_token, email: response.profileObj.email, givenName: response.profileObj.givenName, familyName: response.profileObj.familyName, }}然后它發(fā)送一個我可以用 jwt.io 解碼的令牌，但它顯示“無效簽名”。它包含我的正確信息，但同樣無效。在我的服務(wù)器端，我也嘗試驗證它并失敗了。// This is the token as a stringunencodedToken := *input.IDTokenfmt.Println(unencodedToken)token, err := jwt.Parse(unencodedToken, func(token *jwt.Token) (interface{}, error){ return []byte("What goes here?"), nil})if err != nil { fmt.Println("Could not decode the token") fmt.Println(err)}if token.Valid { fmt.Println("Valid token")} else if ve, ok := err.(*jwt.ValidationError); ok { if ve.Errors&jwt.ValidationErrorMalformed != 0 { fmt.Println("That's not even a token") } else if ve.Errors&(jwt.ValidationErrorExpired|jwt.ValidationErrorNotValidYet) != 0 { // Token is either expired or not active yet fmt.Println("Expired token") } else { fmt.Println("Couldn't handle this token:", err) }} else { fmt.Println("Couldn't handle this token:", err)}其他信息：這一切都在本地完成。app.localhost是請求作為已批準(zhǔn)來源添加的 JWT 的域
1 回答
慕絲7291255
TA貢獻1859條經(jīng)驗 獲得超6個贊
接近：https ://stackoverflow.com/a/61718113/12563520
我們的朋友在這里寫了如何正確驗證 JWT。
token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
if _, ok := token.Method.(*jwt.SigningMethodRS256); !ok {
return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
}
kid, ok := token.Header["kid"].(string)
if !ok {
return nil, errors.New("kid header not found")
}
keys := keySet.LookupKeyID(kid);
if len(keys) == 0 {
return nil, fmt.Errorf("key %v not found", kid)
}
// keys[0].Materialize() doesn't exist anymore
var raw interface{}
return raw, keys[0].Raw(&raw)
})
這是我的完整實現(xiàn)，以滿足谷歌從這里提供的說明：https ://developers.google.com/identity/sign-in/web/backend-auth
我可能比我需要的更頻繁地驗證事情，所以如果有人想編輯或評論，我會做出改變。
// Get the Key
unencodedToken := *input.IDToken
fetchedToken, err := jwk.FetchHTTP("https://www.googleapis.com/oauth2/v3/certs")
// Parse the token with standard claims
token, err := jwt.ParseWithClaims(unencodedToken, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
return nil, gqlerror.Errorf("Unexpected token signing method", token)
}
kid, ok := token.Header["kid"].(string)
if !ok {
fmt.Println("Could not find Key ID")
return nil, gqlerror.Errorf("Could not find key ID in token:", token)
}
keys := fetchedToken.LookupKeyID(kid)
if len(keys) == 0 {
fmt.Println("Could not find key in the signature")
return nil, gqlerror.Errorf("Could not find key in the signature: ", token)
}
var empty interface{}
return empty, keys[0].Raw(&empty)
})
if err != nil {
fmt.Println("Could not decode the token")
fmt.Println(err)
return nil, gqlerror.Errorf("Could not decode the token: ", token)
}
// Check if the token is valid
if token.Valid {
fmt.Println("Valid token")
} else if ve, ok := err.(*jwt.ValidationError); ok {
if ve.Errors&jwt.ValidationErrorMalformed != 0 {
fmt.Println("That's not even a token")
return nil, gqlerror.Errorf("Invalid Token")
} else if ve.Errors&(jwt.ValidationErrorExpired|jwt.ValidationErrorNotValidYet) != 0 {
// Token is either expired or not active yet
fmt.Println("Expired token")
return nil, gqlerror.Errorf("Expired Token:", token)
} else {
fmt.Println("Couldn't handle this token", token, err)
return nil, gqlerror.Errorf(err.Error())
}
} else {
fmt.Println("Couldn't handle this token", token, err)
return nil, gqlerror.Errorf(err.Error())
}
// Check if the claims are valid
err = token.Claims.Valid()
if err != nil {
fmt.Println("Failed validity check", err)
return nil, gqlerror.Errorf("Failed validity check on token", token, err.Error())
}
// Check the custom claims
if claims, ok := token.Claims.(*jwt.StandardClaims); ok && token.Valid {
audienceVerified := claims.VerifyAudience("773117128619-kfrd500nf8bfaq7anl7ee1ae7ucg5kp5.apps.googleusercontent.com", true)
if !audienceVerified {
// TODO Handle failure
fmt.Println("Audience unverified")
return nil, gqlerror.Errorf("Audience unverified on token", token)
}
}
if claims, ok := token.Claims.(*jwt.StandardClaims); ok && token.Valid {
netloc := claims.VerifyIssuer("accounts.google.com", true)
httpVersion := claims.VerifyIssuer("accounts.google.com", true)
if !netloc && !httpVersion {
// TODO Handle failure
fmt.Println("Can't verify issuer")
return nil, gqlerror.Errorf("Can't verify issuer on token", token)
}
}
- 1 回答
- 0 關(guān)注
- 260 瀏覽
添加回答
舉報
0/150
提交
取消