JSON Web Token – DECODE X NET

下記で、JWTをテストしたときとは違い、今回は秘密キー、公開キーをつかってトークンの検証をしてみました。

Postman

引用）
https://qiita.com/hoshimado/items/38dd31f9566a56ec6226
参考）
https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback

環境）Mac(arm64)

まずは、キーペアによるテキストファイルの暗号化、複合化のテストです。

cmd.sh

#!/bin/bash

openssl genpkey -algorithm RSA -out private_key.pem -aes256
openssl rsa -pubout -in private_key.pem -out public_key.pem

cat org.txt
openssl pkeyutl -encrypt -pubin -inkey public_key.pem -in org.txt -out enc.txt
openssl pkeyutl -decrypt -inkey private_key.pem -in enc.txt -out dec.txt
cat dec.txt

#!/bin/bash

openssl genpkey -algorithm RSA -out private_key.pem -aes256

openssl rsa -pubout -in private_key.pem -out public_key.pem

cat org.txt

openssl pkeyutl -encrypt -pubin -inkey public_key.pem -in org.txt -out enc.txt

openssl pkeyutl -decrypt -inkey private_key.pem -in enc.txt -out dec.txt

cat dec.txt

実行

sh cmd.sh
....+.....+++++++++++++++++++++++++++++++++++++++*.........+.+...........................+........+....+......+......+.....+....+..+...+.+...+.....+++++++++++++++++++++++++++++++++++++++*....+.......+........+.......+...++++++
...+...+....+...+..+.+..+.................................+....+..+.+..+......+.+.....+..........+...+...+..+...+...+..........+.....+....+..+....+..+.........+++++++++++++++++++++++++++++++++++++++*........+...+.......+..+......+..........+.........+..+.+........+.+.........+..+...............+.......+..+...+.+..+...+.+...+...+..+......+......+...+++++++++++++++++++++++++++++++++++++++*..+........+.+......+......++++++
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
Enter pass phrase for private_key.pem:
writing RSA key
-- original sample test --
Enter pass phrase for private_key.pem:
-- original sample test --

sh cmd.sh

....+.....+++++++++++++++++++++++++++++++++++++++*.........+.+...........................+........+....+......+......+.....+....+..+...+.+...+.....+++++++++++++++++++++++++++++++++++++++*....+.......+........+.......+...++++++

...+...+....+...+..+.+..+.................................+....+..+.+..+......+.+.....+..........+...+...+..+...+...+..........+.....+....+..+....+..+.........+++++++++++++++++++++++++++++++++++++++*........+...+.......+..+......+..........+.........+..+.+........+.+.........+..+...............+.......+..+...+.+..+...+.+...+...+..+......+......+...+++++++++++++++++++++++++++++++++++++++*..+........+.+......+......++++++

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

Enter pass phrase for private_key.pem:

writing RSA key

-- original sample test --

Enter pass phrase for private_key.pem:

-- original sample test --

キーペアの確認ができたところで、これを使用した、上記引用コードを動かす環境を作成します。
env.sh

#!/bin/bash

base64 -i private_key.pem -o private_key.pem.base64
base64 -i public_key.pem -o public_key.pem.base64

export JWT_PRIVATE_KEY=$(cat private_key.pem.base64)
export JWT_PUBLIC_KEY=$(cat public_key.pem.base64)
export JWT_PASSPHRASE=password
export JWT_ISSUER=user01

#!/bin/bash

base64 -i private_key.pem -o private_key.pem.base64

base64 -i public_key.pem -o public_key.pem.base64

export JWT_PRIVATE_KEY=$(cat private_key.pem.base64)

export JWT_PUBLIC_KEY=$(cat public_key.pem.base64)

export JWT_PASSPHRASE=password

export JWT_ISSUER=user01

JWT発行
jwt_publish.js

var jwt = require('jsonwebtoken');

var envFactory = {
    publicBase64     : process.env.JWT_PUBLIC_KEY,
    secretBase64     : process.env.JWT_PRIVATE_KEY,
    passphraseSecret : process.env.JWT_PASSPHRASE,
    issuerUri        : process.env.JWT_ISSUER,
};

var publishApiKeyAsJwt = function (params) {
    var env = envFactory;
    var claim = {
        iss : env.issuerUri,
        aud : params.aud,
        sub : params.sub,
        iat : Math.floor(Date.now() / 1000),
        exp : Math.floor(Date.now() / 1000) + 24 * 60
    };
    var token = jwt.sign(
        claim,
        {
            key: Buffer.from(env.secretBase64, 'base64'),
            passphrase: env.passphraseSecret},
        {
            algorithm : 'RS256'
        }
    );
    return Promise.resolve(token);
};

publishApiKeyAsJwt({
    sub: 'user01',
    aud: 'client01'
}).then((token)=>{
    console.log(token);
});

var jwt = require('jsonwebtoken');

var envFactory = {

publicBase64 : process.env.JWT_PUBLIC_KEY,

secretBase64 : process.env.JWT_PRIVATE_KEY,

passphraseSecret : process.env.JWT_PASSPHRASE,

issuerUri : process.env.JWT_ISSUER,

};

var publishApiKeyAsJwt = function (params) {

var env = envFactory;

var claim = {

iss : env.issuerUri,

aud : params.aud,

sub : params.sub,

iat : Math.floor(Date.now() / 1000),

exp : Math.floor(Date.now() / 1000) + 24 * 60

};

var token = jwt.sign(

claim,

{

key: Buffer.from(env.secretBase64, 'base64'),

passphrase: env.passphraseSecret},

{

algorithm : 'RS256'

}

);

return Promise.resolve(token);

};

publishApiKeyAsJwt({

sub: 'user01',

aud: 'client01'

}).then((token)=>{

console.log(token);

});

JWT検証
jwt_verify.js

var jwt = require('jsonwebtoken');

var envFactory = {
    publicBase64     : process.env.JWT_PUBLIC_KEY,
};

var verifyApiKeyAsJwt = function (accessTokenAwJwt, audience) {
    var env = envFactory;
    var publicKey = Buffer.from(env.publicBase64, 'base64');
    var token = accessTokenAwJwt;
    var options = {algorithms: ['RS256']};

    console.log(env.publicBase64)
    console.log('-------')
    console.log(token)
    var promise;

    var d = jwt.decode(token)
    console.log(d)
    if(token && publicKey){
        if(audience){
            options['audience'] = audience;
        }
        return promise = new Promise((resolve,reject)=>{
            // https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback
            jwt.verify(
                token,
                publicKey,
                options,
                (err, decoded)=>{
                    if(err){
                        reject(err);
                    }else{
                        resolve(decoded)
                    }
                }
            );
        });
    }else{
        promise = Promise.reject();
    }
    return promise;
};

verifyApiKeyAsJwt(
    process.argv[2],
   'client01'
).then((token)=>{
    console.log(token);
}).catch((err)=>{
    console.log(err);
});

var jwt = require('jsonwebtoken');

var envFactory = {

publicBase64 : process.env.JWT_PUBLIC_KEY,

};

var verifyApiKeyAsJwt = function (accessTokenAwJwt, audience) {

var env = envFactory;

var publicKey = Buffer.from(env.publicBase64, 'base64');

var token = accessTokenAwJwt;

var options = {algorithms: ['RS256']};

console.log(env.publicBase64)

console.log('-------')

console.log(token)

var promise;

var d = jwt.decode(token)

console.log(d)

if(token && publicKey){

if(audience){

options['audience'] = audience;

}

return promise = new Promise((resolve,reject)=>{

// https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback

jwt.verify(

token,

publicKey,

options,

(err, decoded)=>{

if(err){

reject(err);

}else{

resolve(decoded)

}

);

});

}else{

promise = Promise.reject();

}

return promise;

};

verifyApiKeyAsJwt(

process.argv[2],

'client01'

).then((token)=>{

console.log(token);

}).catch((err)=>{

console.log(err);

});

実行

source env.sh
node jwt_publish.js > jwt
node jwt_verify.js $(cat jwt)

成功すると認証情報が表示されます。

{
  iss: 'user01',
  aud: 'client01',
  sub: 'user01',
  iat: 1709955959,
  exp: 1709957399
}
{
  iss: 'user01',
  aud: 'client01',
  sub: 'user01',
  iat: 1709955959,
  exp: 1709957399
}

{

iss: 'user01',

aud: 'client01',

sub: 'user01',

iat: 1709955959,

exp: 1709957399

}

{

iss: 'user01',

aud: 'client01',

sub: 'user01',

iat: 1709955959,

exp: 1709957399

}

JWTのライブラリが正しく動く確認でした。