As noticed in my previous commit, the existing jwt libraries added a lot of performance cost between jwt-featured requests and simple requests. That's why a new custom JWT parser was created. This commit adds our custom jwt parser as the underline token signer and verifier

_examples/auth/jwt/refresh-token/main.go

@@ -1,57 +1,65 @@
 package main
 
 import (
+	"fmt"
 	"time"
 
 	"github.com/kataras/iris/v12"
 	"github.com/kataras/iris/v12/middleware/jwt"
 )
 
+const (
+	accessTokenMaxAge  = 10 * time.Minute
+	refreshTokenMaxAge = time.Hour
+)
+
+var (
+	privateKey, publicKey = jwt.MustLoadRSA("rsa_private_key.pem", "rsa_public_key.pem")
+
+	signer   = jwt.NewSigner(jwt.RS256, privateKey, accessTokenMaxAge)
+	verifier = jwt.NewVerifier(jwt.RS256, publicKey)
+)
+
 // UserClaims a custom access claims structure.
 type UserClaims struct {
-	// In order to separate refresh and access tokens on validation level:
-	// - Set a different Issuer, with a field of: Issuer string `json:"iss"`
-	// - Set the Iris JWT's json tag option "required" on an access token field,
-	//   e.g. Username string `json:"username,required"`
-	// - Let the middleware validate the correct one based on the given MaxAge,
-	//   which should be different between refresh and max age (refersh should be bigger)
-	//   by setting the `jwt.ExpectRefreshToken` on Verify/VerifyToken/VerifyTokenString
-	//   (see `refreshToken` function below)
-	ID       string `json:"user_id"`
+	ID string `json:"user_id"`
+	// Do: `json:"username,required"` to have this field required
+	// or see the Validate method below instead.
 	Username string `json:"username"`
 }
 
+// Validate completes the middleware's custom ClaimsValidator.
+// It will not accept a token which its claims missing the username field
+// (useful to not accept refresh tokens generated by the same algorithm).
+func (u *UserClaims) Validate() error {
+	if u.Username == "" {
+		return fmt.Errorf("username field is missing")
+	}
+
+	return nil
+}
+
 // For refresh token, we will just use the jwt.Claims
 // structure which contains the standard JWT fields.
 
 func main() {
 	app := iris.New()
+	app.OnErrorCode(iris.StatusUnauthorized, handleUnauthorized)
 
-	j := jwt.HMAC(15*time.Minute, "secret", "itsa16bytesecret")
-
-	app.Get("/authenticate", func(ctx iris.Context) {
-		generateTokenPair(ctx, j)
-	})
-
-	app.Get("/refresh", func(ctx iris.Context) {
-		refreshToken(ctx, j)
-	})
+	app.Get("/authenticate", generateTokenPair)
+	app.Get("/refresh", refreshToken)
 
 	protectedAPI := app.Party("/protected")
 	{
-		protectedAPI.Use(j.Verify(func() interface{} {
+		verifyMiddleware := verifier.Verify(func() interface{} {
 			return new(UserClaims)
-		})) // OR j.VerifyToken(ctx, &claims, jwt.MeetRequirements(&UserClaims{}))
+		})
+
+		protectedAPI.Use(verifyMiddleware)
 
 		protectedAPI.Get("/", func(ctx iris.Context) {
-			// Get token info, even if our UserClaims does not embed those
-			// through GetTokenInfo:
-			expiresAt := jwt.GetTokenInfo(ctx).Claims.Expiry.Time()
-			// Get your custom JWT claims through Get,
-			// which is a shortcut of GetTokenInfo(ctx).Value:
 			claims := jwt.Get(ctx).(*UserClaims)
-
-			ctx.Writef("Username: %s\nExpires at: %s\n", claims.Username, expiresAt)
+			ctx.Writef("Username: %s\n", claims.Username)
 		})
 	}
 
@@ -59,33 +67,33 @@ func main() {
 	// http://localhost:8080/authenticate (200) (response JSON {access_token, refresh_token})
 	// http://localhost:8080/protected?token={access_token} (200)
 	// http://localhost:8080/protected?token={refresh_token} (401)
-	// http://localhost:8080/refresh?token={refresh_token}
+	// http://localhost:8080/refresh?refresh_token={refresh_token}
 	// OR http://localhost:8080/refresh (request JSON{refresh_token = {refresh_token}}) (200) (response JSON {access_token, refresh_token})
-	// OR http://localhost:8080/refresh (request PLAIN TEXT of {refresh_token}) (200) (response JSON {access_token, refresh_token})
-	// http://localhost:8080/refresh?token={access_token} (401)
+	// http://localhost:8080/refresh?refresh_token={access_token} (401)
 	app.Listen(":8080")
 }
 
-func generateTokenPair(ctx iris.Context, j *jwt.JWT) {
+func generateTokenPair(ctx iris.Context) {
 	// Simulate a user...
 	userID := "53afcf05-38a3-43c3-82af-8bbbe0e4a149"
 
 	// Map the current user with the refresh token,
 	// so we make sure, on refresh route, that this refresh token owns
 	// to that user before re-generate.
-	refresh := jwt.Claims{Subject: userID}
+	refreshClaims := jwt.Claims{Subject: userID}
 
-	access := UserClaims{
+	accessClaims := UserClaims{
 		ID:       userID,
 		Username: "kataras",
 	}
 
 	// Generates a Token Pair, long-live for refresh tokens, e.g. 1 hour.
-	// Second argument is the refresh claims and,
-	// the last one is the access token's claims.
-	tokenPair, err := j.TokenPair(1*time.Hour, refresh, access)
+	// First argument is the access claims,
+	// second argument is the refresh claims,
+	// third argument is the refresh max age.
+	tokenPair, err := signer.NewTokenPair(accessClaims, refreshClaims, refreshTokenMaxAge)
 	if err != nil {
-		ctx.Application().Logger().Debugf("token pair: %v", err)
+		ctx.Application().Logger().Errorf("token pair: %v", err)
 		ctx.StopWithStatus(iris.StatusInternalServerError)
 		return
 	}
@@ -95,14 +103,12 @@ func generateTokenPair(ctx iris.Context, j *jwt.JWT) {
 	ctx.JSON(tokenPair)
 }
 
-func refreshToken(ctx iris.Context, j *jwt.JWT) {
-	/*
-		We could pass a jwt.Claims pointer as the second argument,
-		but we don't have to because the method already returns
-		the standard JWT claims information back to us:
-		refresh, err := VerifyRefreshToken(ctx, nil)
-	*/
-
+// There are various methods of refresh token, depending on the application requirements.
+// In this example we will accept a refresh token only, we will verify only a refresh token
+// and we re-generate a whole new pair. An alternative would be to accept a token pair
+// of both access and refresh tokens, verify the refresh, verify the access with a Leeway time
+// and check if its going to expire soon, then generate a single access token.
+func refreshToken(ctx iris.Context) {
 	// Assuming you have access to the current user, e.g. sessions.
 	//
 	// Simulate a database call against our jwt subject
@@ -110,23 +116,46 @@ func refreshToken(ctx iris.Context, j *jwt.JWT) {
 	// * Note: You can remove the ExpectSubject and do this validation later on by yourself.
 	currentUserID := "53afcf05-38a3-43c3-82af-8bbbe0e4a149"
 
+	// Get the refresh token from ?refresh_token=$token OR
+	// the request body's JSON{"refresh_token": "$token"}.
+	refreshToken := []byte(ctx.URLParam("refresh_token"))
+	if len(refreshToken) == 0 {
+		// You can read the whole body with ctx.GetBody/ReadBody too.
+		var tokenPair jwt.TokenPair
+		if err := ctx.ReadJSON(&tokenPair); err != nil {
+			ctx.StopWithError(iris.StatusBadRequest, err)
+			return
+		}
+
+		refreshToken = tokenPair.RefreshToken
+	}
+
 	// Verify the refresh token, which its subject MUST match the "currentUserID".
-	_, err := j.VerifyRefreshToken(ctx, nil, jwt.ExpectSubject(currentUserID))
+	_, err := verifier.VerifyToken(refreshToken, jwt.Expected{Subject: currentUserID})
 	if err != nil {
-		ctx.Application().Logger().Debugf("verify refresh token: %v", err)
+		ctx.Application().Logger().Errorf("verify refresh token: %v", err)
 		ctx.StatusCode(iris.StatusUnauthorized)
 		return
 	}
 
 	/* Custom validation checks can be performed after Verify calls too:
 	currentUserID := "53afcf05-38a3-43c3-82af-8bbbe0e4a149"
-	userID := refresh.Claims.Subject
+	userID := verifiedToken.StandardClaims.Subject
 	if userID != currentUserID {
 		ctx.StopWithStatus(iris.StatusUnauthorized)
 		return
 	}
 	*/
 
-	// All OK, re-generate the new pair and send to client.
-	generateTokenPair(ctx, j)
+	// All OK, re-generate the new pair and send to client,
+	// we could only generate an access token as well.
+	generateTokenPair(ctx)
+}
+
+func handleUnauthorized(ctx iris.Context) {
+	if err := ctx.GetErr(); err != nil {
+		ctx.Application().Logger().Errorf("unauthorized: %v", err)
+	}
+
+	ctx.WriteString("Unauthorized")
 }

_examples/auth/jwt/refresh-token/rsa_private_key.pem

@@ -0,0 +1,27 @@
+-----BEGIN PRIVATE KEY-----
+MIIEowIBAAKCAQEArwO0q8WbBvrplz3lTQjsWu66HC7M3mVAjmjLq8Wj/ipqVtiJ
+MrUL9t/0q9PNO/KX9u+HayFNYM4TnYkXVZX3M5E31W8fPPy74D/XpqFwrwT7bAEw
+pT51JJyxkoBAyOh08lmR2EYvpGF7qErra7qbkk4LGFbhoFCXdMLXguT4rPymkzFH
+dQrmGYOBS+v9imSuJddCZpXyv6Ko7AKB4mhzg4RC5RJZO5GEHVUrSMHxZB0syF8c
+U+28iL8A7SlGKTNZPZiHmCQVRqA6WlllL/YV/t6p24kaNZBUp9JGbAzOeKuVUv2u
+vfNKwB/aBwnFKauM9I6RmC4bnI1nGHjETlNNWwIDAQABAoIBAHBPKHmybTGlgpET
+nzo4J7SSzcuYHM/6mdrJVSn9wqcwAN2KR0DK/cqHHTPGz0VRAEPuojAVRtqAZAYM
+G3VIr0HgRrwoextf9BCL549+uhkWUWGVwenIktPT2f/xXaGPyrxazkTDhX8vL3Nn
+4HtZXMweWPBdkJyYGxlKj5Hn7czTpG3VKpvpHeFlY4caF+FT2as1jcQ1MjPnGslH
+Ss+sYPBp/70w2T114Z4wlR4OryI1LeuFeje9obrn0HAmJd0ZKYM21awp/YWJ/y8J
+wIH6XQ4AGR9iTRhuffK1XRM/Iec3K/YhOn4PtKdT7OsIujAKY7A9WcqSFif+/E1g
+jom3eMECgYEAw5Zdqt2uZ19FuDlDTW4Kw8Z2NyXgWp33LkAXG1mJw7bqDhfPeB1c
+xTPs4i4RubGuDusygxZ3GgJAO7tLGzNQfWNoi03mM7Q/BJGkA9VZr+U28zsSRQOQ
++J9xNsdgUMP1js7X/NNM2bxTC8zy9wEsWr9JwNo1C7uHTE9WXAumBI8CgYEA5RKV
+niSbyko36W3Vi0ZnGBrRhy0Eiq85V2mhWzHN+txcv+8aISow2wioTUzrpR0aVZ4j
+v9+siJENlALVzdUFihy0lPxHqLJT746Cixz95WRTLkdHeNllV0DMfOph2x3j1Hjd
+3PgTv+jqb6npY0/2Vb2pp4t/zVikGaObsAalSHUCgYBne8B1bjMfqI3n6gxNBIMX
+kILtrNGmwFuPEgPnyZkVf0sZR8nSwJ5cDJwyE7P3LyZr6E9igllj3nsD35Xef2j/
+3r/qrL2275BEJ5bDHHgGk91eFgwVjcx/b0TkedrhAL2E4LXwpA/OSFEcNkT7IZjJ
+Ltqj+hAE9CSi4HtN2i/tywKBgBotKn28zzSpkIQTMgDNVcCSZ/kbctZqOZI8lty1
+70TIY6znJMQ/bv/ImHrk3FSs47J+9LTbWXrtoHCWdlokCpMCvrv7rDCh2Cea0F4X
+PQg2k67JJGix5vu2guePXQlN/Bfui+PRUWhvtEJ4VxwrKgoYN0fXEA6mH3JymLrf
+t4l1AoGBALk4o9swGjw7MnByYJmOidlJ0p9Wj1BWWJJYoYX2VfjIuvZj6BNxkEb0
+aVmYRC+40e9L1rOyrlyaO/TiQaIPE4ljVs/AmMKGz8sIcVfwdyERH3nDrXxvlAav
+lSvfKoYM3J+5c63CDuU45gztpmavNerzCczqYTLOEMx1eCLHOQlx
+-----END PRIVATE KEY-----

_examples/auth/jwt/refresh-token/rsa_public_key.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArwO0q8WbBvrplz3lTQjs
+Wu66HC7M3mVAjmjLq8Wj/ipqVtiJMrUL9t/0q9PNO/KX9u+HayFNYM4TnYkXVZX3
+M5E31W8fPPy74D/XpqFwrwT7bAEwpT51JJyxkoBAyOh08lmR2EYvpGF7qErra7qb
+kk4LGFbhoFCXdMLXguT4rPymkzFHdQrmGYOBS+v9imSuJddCZpXyv6Ko7AKB4mhz
+g4RC5RJZO5GEHVUrSMHxZB0syF8cU+28iL8A7SlGKTNZPZiHmCQVRqA6WlllL/YV
+/t6p24kaNZBUp9JGbAzOeKuVUv2uvfNKwB/aBwnFKauM9I6RmC4bnI1nGHjETlNN
+WwIDAQAB
+-----END PUBLIC KEY-----