blob: d6901d9adb52bde1914ed614bc97f0a4a47057fb [file] [log] [blame]
khenaidooab1f7bd2019-11-14 14:00:27 -05001package jwt
2
3import (
4 "bytes"
5 "encoding/json"
6 "fmt"
7 "strings"
8)
9
10type Parser struct {
11 ValidMethods []string // If populated, only these methods will be considered valid
12 UseJSONNumber bool // Use JSON Number format in JSON decoder
13 SkipClaimsValidation bool // Skip claims validation during token parsing
14}
15
16// Parse, validate, and return a token.
17// keyFunc will receive the parsed token and should return the key for validating.
18// If everything is kosher, err will be nil
19func (p *Parser) Parse(tokenString string, keyFunc Keyfunc) (*Token, error) {
20 return p.ParseWithClaims(tokenString, MapClaims{}, keyFunc)
21}
22
23func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc) (*Token, error) {
24 token, parts, err := p.ParseUnverified(tokenString, claims)
25 if err != nil {
26 return token, err
27 }
28
29 // Verify signing method is in the required set
30 if p.ValidMethods != nil {
31 var signingMethodValid = false
32 var alg = token.Method.Alg()
33 for _, m := range p.ValidMethods {
34 if m == alg {
35 signingMethodValid = true
36 break
37 }
38 }
39 if !signingMethodValid {
40 // signing method is not in the listed set
41 return token, NewValidationError(fmt.Sprintf("signing method %v is invalid", alg), ValidationErrorSignatureInvalid)
42 }
43 }
44
45 // Lookup key
46 var key interface{}
47 if keyFunc == nil {
48 // keyFunc was not provided. short circuiting validation
49 return token, NewValidationError("no Keyfunc was provided.", ValidationErrorUnverifiable)
50 }
51 if key, err = keyFunc(token); err != nil {
52 // keyFunc returned an error
53 if ve, ok := err.(*ValidationError); ok {
54 return token, ve
55 }
56 return token, &ValidationError{Inner: err, Errors: ValidationErrorUnverifiable}
57 }
58
59 vErr := &ValidationError{}
60
61 // Validate Claims
62 if !p.SkipClaimsValidation {
63 if err := token.Claims.Valid(); err != nil {
64
65 // If the Claims Valid returned an error, check if it is a validation error,
66 // If it was another error type, create a ValidationError with a generic ClaimsInvalid flag set
67 if e, ok := err.(*ValidationError); !ok {
68 vErr = &ValidationError{Inner: err, Errors: ValidationErrorClaimsInvalid}
69 } else {
70 vErr = e
71 }
72 }
73 }
74
75 // Perform validation
76 token.Signature = parts[2]
77 if err = token.Method.Verify(strings.Join(parts[0:2], "."), token.Signature, key); err != nil {
78 vErr.Inner = err
79 vErr.Errors |= ValidationErrorSignatureInvalid
80 }
81
82 if vErr.valid() {
83 token.Valid = true
84 return token, nil
85 }
86
87 return token, vErr
88}
89
90// WARNING: Don't use this method unless you know what you're doing
91//
92// This method parses the token but doesn't validate the signature. It's only
93// ever useful in cases where you know the signature is valid (because it has
94// been checked previously in the stack) and you want to extract values from
95// it.
96func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Token, parts []string, err error) {
97 parts = strings.Split(tokenString, ".")
98 if len(parts) != 3 {
99 return nil, parts, NewValidationError("token contains an invalid number of segments", ValidationErrorMalformed)
100 }
101
102 token = &Token{Raw: tokenString}
103
104 // parse Header
105 var headerBytes []byte
106 if headerBytes, err = DecodeSegment(parts[0]); err != nil {
107 if strings.HasPrefix(strings.ToLower(tokenString), "bearer ") {
108 return token, parts, NewValidationError("tokenstring should not contain 'bearer '", ValidationErrorMalformed)
109 }
110 return token, parts, &ValidationError{Inner: err, Errors: ValidationErrorMalformed}
111 }
112 if err = json.Unmarshal(headerBytes, &token.Header); err != nil {
113 return token, parts, &ValidationError{Inner: err, Errors: ValidationErrorMalformed}
114 }
115
116 // parse Claims
117 var claimBytes []byte
118 token.Claims = claims
119
120 if claimBytes, err = DecodeSegment(parts[1]); err != nil {
121 return token, parts, &ValidationError{Inner: err, Errors: ValidationErrorMalformed}
122 }
123 dec := json.NewDecoder(bytes.NewBuffer(claimBytes))
124 if p.UseJSONNumber {
125 dec.UseNumber()
126 }
127 // JSON Decode. Special case for map type to avoid weird pointer behavior
128 if c, ok := token.Claims.(MapClaims); ok {
129 err = dec.Decode(&c)
130 } else {
131 err = dec.Decode(&claims)
132 }
133 // Handle decode error
134 if err != nil {
135 return token, parts, &ValidationError{Inner: err, Errors: ValidationErrorMalformed}
136 }
137
138 // Lookup signature method
139 if method, ok := token.Header["alg"].(string); ok {
140 if token.Method = GetSigningMethod(method); token.Method == nil {
141 return token, parts, NewValidationError("signing method (alg) is unavailable.", ValidationErrorUnverifiable)
142 }
143 } else {
144 return token, parts, NewValidationError("signing method (alg) is unspecified.", ValidationErrorUnverifiable)
145 }
146
147 return token, parts, nil
148}