javascript - Spring MVC + AngularJS + JWT Token Expiration - HowTo -
i ensure json web tokens revoked/expire after configurable ammount of time , have following set up:
security filter:
import io.jsonwebtoken.claims; import io.jsonwebtoken.jwts; import yourwebproject2.service.userservice; import org.apache.commons.lang.stringutils; import org.slf4j.logger; import org.slf4j.loggerfactory; import org.springframework.beans.factory.annotation.autowired; import org.springframework.web.filter.onceperrequestfilter; import javax.servlet.filterchain; import javax.servlet.servletexception; import javax.servlet.http.httpservletrequest; import javax.servlet.http.httpservletresponse; import java.io.ioexception; import java.util.arraylist; import java.util.list; import java.util.regex.pattern; /** * @author: kameshr */ public class jwttokenauthfilter extends onceperrequestfilter { private static list<pattern> auth_routes = new arraylist<>(); private static list<string> no_auth_routes = new arraylist<>(); public static final string jwt_key = "jwt-token-secret"; static { auth_routes.add(pattern.compile("/api/*")); no_auth_routes.add("/api/user/authenticate"); no_auth_routes.add("/api/user/register"); } private logger log = loggerfactory.getlogger(jwttokenauthfilter.class); @autowired private userservice userservice; @override protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain filterchain) throws servletexception, ioexception { string authorizationheader = request.getheader("authorization"); string authenticationheader = request.getheader("authentication"); string route = request.getrequesturi(); // no auth route matching boolean needsauthentication = false; (pattern p : auth_routes) { if (p.matcher(route).matches()) { needsauthentication = true; break; } } if(route.startswith("/api/")) { needsauthentication = true; } if (no_auth_routes.contains(route)) { needsauthentication = false; } // checking whether current route needs authenticated if (needsauthentication) { // check authorization header presence string authheader = null; if (authorizationheader == null || authorizationheader.equalsignorecase("")) { if (authenticationheader == null || authenticationheader.equalsignorecase("")) { authheader = null; } else { authheader = authenticationheader; log.info("authentication: " + authenticationheader); } } else { authheader = authorizationheader; log.info("authorization: " + authorizationheader); } if (stringutils.isblank(authheader) || !authheader.startswith("bearer ")) { throw new authcredentialsmissingexception("missing or invalid authorization header."); } final string token = authheader.substring(7); // part after "bearer " try { final claims claims = jwts.parser().setsigningkey(jwt_key) .parseclaimsjws(token).getbody(); request.setattribute("claims", claims); // since authentication process if finished // move request forward filterchain.dofilter(request, response); } catch (final exception e) { throw new authenticationfailedexception("invalid token. cause:"+e.getmessage()); } } else { filterchain.dofilter(request, response); } } } method creates authentication token:
string token = jwts.builder().setsubject(user.getemail()) .claim("role", user.getrole().name()).setissuedat(new date()) .signwith(signaturealgorithm.hs256, jwttokenauthfilter.jwt_key).compact(); authresp.put("token", token); authresp.put("user", user); above have claims using on jwt , request token revoked after x ammount of time(of inactivity if possible).
how achieve using jwt / spring mvc / angular js / spring security
set expiration token
string token = jwts.builder() .setsubject(user.getemail()) .claim("role", user.getrole().name()) .setissuedat(new date()) .setexpiration(expirationdate) .signwith(signaturealgorithm.hs256, wttokenauthfilter.jwt_key) .compact(); then, parseclaimsjws raise expiredjwtexception if currenttime>expirationdate
to revoke valid token hard technique no easy solutions:
1) maintain blacklist in server , compare each request
2) set small expiration time , issue new token
3) insert login time in token , compare if acomplish criteria
4) remove jwt in client side
