Module: JwtAuthenticable::Auth

Includes:
Exceptions, Responses
Defined in:
lib/jwt_authenticable/auth.rb

Overview

Module that adds jwt authentication methods to the client

Instance Method Summary collapse

Methods included from Responses

#accepted, #access_denied, #created, #destroyed, #no_content, #not_found, #payload_too_large, #render_page, #render_resource, #render_success_resource, #unauthorized, #unprocessable_entity, #validation_error

Instance Method Details

#algorithm ⇒ Object 



62
63
64
 
# File 'lib/jwt_authenticable/auth.rb', line 62

def algorithm
  supported_algos.find { |algo| algo == JwtAuthenticable.config.algorithm } || 'HS256'
end

#authenticate_user!(skip_2fa: false) ⇒ Object

Authenticates a user.

Raises:

  • MissingAuthScope if the jwt does not have the right scope



14
15
16
17
18
19
 
# File 'lib/jwt_authenticable/auth.rb', line 14

def authenticate_user!(skip_2fa: false)
  validate_jwt_token! token: authorization_token!, skip_2fa: skip_2fa
rescue MissingAuth, MissingAuthScope, InvalidAuthScheme, TwoFANotEnabledError, JWT::VerificationError,
       JWT::ExpiredSignature => e
  unauthorized(e.message)
end

#authenticate_user_without_2fa! ⇒ Object 



21
22
23
 
# File 'lib/jwt_authenticable/auth.rb', line 21

def authenticate_user_without_2fa!
  authenticate_user!(skip_2fa: true)
end

#authorization_token! ⇒ String

Note:

For now we only support Bearer schema with JWT

Extracts the authorization token from the Authorization header

Returns:

  • (String) —

    the JWT token string

Raises:



50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/jwt_authenticable/auth.rb', line 50

def authorization_token!
  raise InvalidIncluder unless defined? request

  auth_token = request.headers['Authorization']
  auth_token ||= request.cookies['bearer_token']

  raise MissingAuth if auth_token.nil? || auth_token == ''
  raise InvalidAuthScheme if auth_token[0..6] != 'Bearer '

  auth_token[7..]
end

#supported_algos ⇒ Object 



66
67
68
 
# File 'lib/jwt_authenticable/auth.rb', line 66

def supported_algos
  SUPPORTED_ALGOS
end

#validate_jwt_token!(token:, skip_2fa: false) ⇒ Hash

Validate that the JWT token signature and the following claims are valid:

  • exp
  • scope

Parameters:

  • token (String) —

    JWT token string (just the token, with the header, payload and signature separated by '.')

  • skip_2fa (Boolean) (defaults to: false) —

    When set to true it will not raise a TwoFANotEnabledError if the jwt payload does not contain the 2fa claim.

Returns:

  • (Hash) —

    the JWT payload

Raises:

  • AuthorizationError if the user is trying to login with the incorrect rights.



35
36
37
38
39
40
41
42
43
 
# File 'lib/jwt_authenticable/auth.rb', line 35

def validate_jwt_token!(token:, skip_2fa: false)
  # NOTE: it is still safe if JWT_SECRET_KEY is not set. The method will trigger a JWT exception
  payload = JWT.decode(token, JwtAuthenticable.config.jwt_secret_key, true,
                       { algorithm: algorithm }).first

  raise TwoFANotEnabledError if JwtAuthenticable.config.enforce_2fa && !payload['2fa'] && !skip_2fa

  payload
end