如何验证JWT签名? [英] how to verify JWT signature?

问题描述

我想通过Go AppEngine后端对Android用户进行身份验证，

I want to authenticate Android users with a Go AppEngine backend,

通过遵循可以使用 https://code.google.com/p/google-api-go-client/库.

与AppEngine一起使用时必须进行一些安装调整，我在

some installation tweaks are necessary for using it with AppEngine, I found some pointers at http://golangtutorials.blogspot.co.il/2011/11/using-external-api-in-go-appengine.html

根据文档:验证签名 事实证明，这是使用Google公钥/私钥对签名的，Google会在www.googleapis.com/oauth2/v1/certs上发布公钥(我们会定期更改)；继续看看.

according to the doc: "Verify Signature It turns out that this is signed using a Google public/private key pair, and Google publishes the public keys (which we change regularly) at www.googleapis.com/oauth2/v1/certs; go ahead and have a look.

您必须验证ID令牌(实际上是JSON Web令牌)是否已使用这些证书之一签名.幸运的是，周围有不错的图书馆可以做到这一点.在这篇文章中，我将提供Java，Ruby和PHP的指针.

You have to verify that the ID Token, which is actually a JSON Web Token, was signed with one of those certs. Fortunately, there are decent libraries around to do this; in this post, I’ll give pointers for Java, Ruby, and PHP.

这些库可以缓存Google证书，并且仅在需要时刷新它们，因此验证(几乎总是)是一个快速的静态调用."

The libraries can cache the Google certs and only refresh them when required, so the verification is (almost always) a fast static call."

如何在Go中验证令牌是否已由Google签名?

how do I verify in Go that the token was signed by Google?

推荐答案

这就是我最终要做的事情(使用 https://github.com/dgrijalva/jwt-go ):

this is what I ended up doing (using https://github.com/dgrijalva/jwt-go):

package XXX

import (
    "errors"
    oauth2 "code.google.com/p/google-api-go-client/oauth2/v2"
    "jwt"
    "appengine"
    "appengine/urlfetch"
)

func getTokeninfo(c appengine.Context, token string) (*oauth2.Tokeninfo, error) {
    client := urlfetch.Client(c)

    oauth2Svc, err := oauth2.New(client) 

    if err != nil {
        return nil, err
    }

    return oauth2Svc.Tokeninfo().Id_token(token).Do()
}

func verifyToken(c appengine.Context, token string) (string, error) {
    parsedToken, err := jwt.Parse(token)

    if err != nil {
        c.Debugf(err.Error())
        return "", err
    }

    if parsedToken.Claims["aud"] != "XXX.apps.googleusercontent.com" {
        c.Debugf("aud mismatch")
        return "", errors.New("Aud mismatch")
    }

    if (parsedToken.Claims["azp"] != "XXX.apps.googleusercontent.com") && 
        (parsedToken.Claims["azp"] != "XXX.apps.googleusercontent.com") {

        c.Debugf("azp mismatch")
        return "", errors.New("Azp mismatch")
    }

    ti, err := getTokeninfo(c, token)

    if err != nil {
        c.Debugf(err.Error())
        return "", err
    }

    if (ti.Issued_to != "XXX.apps.googleusercontent.com") &&
        (ti.Issued_to != "XXX.apps.googleusercontent.com") {

        c.Debugf("cid mismatch")
        return "", errors.New("Client ID mismatch")
    }

    return ti.User_id, nil
}

这篇关于如何验证JWT签名?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！