Revize a800985e

refs #6742: Pridan middleware pro kontrolu JWT.

backend/.env

@@ -12 +12 @@
 CACHE_DRIVER=memcached
 QUEUE_DRIVER=sync
 
+
+# ==============
+# Nastaveni JWT
+# ==============
 # doba platnosti JWT v sekundach
 JWT_DURATION=1800
+
 # JWT iss parametr
 JWT_ISS=aswi-doprava
+
+# Tajny klic pro sifrovani JWT
 JWT_SECRET=asdfkeylol
+
+# zapnuti/vypnuti JWT overovani
+JWT_AUTH_ENABLED=true
+
+# nazev polozky v hlavicce http requestu ktera obsahuje JWT
+JWT_HEADER_NAME=jwt

backend/app/Http/Controllers/TokenController.php

@@ -9 +9 @@
 namespace App\Http\Controllers;
 
 use \Firebase\JWT\JWT;
+use Illuminate\Http\Request;
 
 class TokenController extends Controller
 {
     /**
      * Vygeneruje nový token pro JWT autorizaci.
      */
-    public function generateToken() {
+    public function generateToken(Request $request) {
         $duration = env('JWT_DURATION', 1800);
 
         // parametry jwt
@@ -28 +29 @@
         $token = array(
             'iss' => $iss,
             'iat' => $iat,
-            'exp' => $exp
+            'exp' => $exp,
+            'ipaddr' => $request->ip(),
+            'user-agent' => $request->header('User-Agent')
         );
 
-        $jwt = JWT::encode($token, $key);
+        $jwt = JWT::encode($token, $key, 'HS256');
 
         return $jwt;
     }

backend/app/Http/Middleware/JWTAuthenticate.php

@@ +1 @@
+<?php
+/**
+ * Created by PhpStorm.
+ * User: Zdenda
+ * Date: 29.4.2018
+ * Time: 11:26
+ */
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Firebase\JWT\JWT;
+use Illuminate\Http\Request;
+
+/**
+ * Middleware slouzici ke kontrole JWT v hlavicce requestu (pokud je JWT overovani zapnute).
+ *
+ * @package App\Http\Middleware
+ */
+class JWTAuthenticate
+{
+    public function handle(Request $request, Closure $next) {
+        // pokud je JWT overovani vypnute, nedelej nic
+        if(!env('JWT_AUTH_ENABLED')) {
+            return $next($request);
+        }
+
+        $jwtHeaderName = env('JWT_HEADER_NAME', 'jwt');
+        $jwt = $request->header($jwtHeaderName);
+        if ($jwt == null) {
+            // token chybi
+            return response('Unauthorized.', 401);
+        }
+
+        $key = env('JWT_SECRET', '');
+        $decoded = null;
+        try {
+            $decoded = JWT::decode($jwt, $key, array('HS256'));
+        } catch (\Exception $ex ) {
+            // jakakoliv chyba pri dekodovani (i expirace) => 401
+            return response('Unauthorized.', 401);
+        }
+
+        // kontrola, ze token nebyl odcizen: musi sedet ip a prohlizec odesilatele
+        $decoded_array = (array) $decoded;
+
+        if($this->checkJwt($request, $decoded_array)) {
+            return $next($request);
+        } else {
+            return response('Unauthorized.', 401);
+        }
+    }
+
+    /**
+     * Zkontroluje jwt rozkodovany do pole proti hodnotam z requestu. Pokud hodnoty nesedi vrati false.
+     * Expirovani tokenu zde neni kontrolovano - melo by byt uz pri dekodovani tokenu.
+     *
+     * @param Request $request Request.
+     * @param array $jwt JWT rozkodovany do pole.
+     * @return True pokud je JWT v poradku, false pokud ne.
+     */
+    private function checkJwt(Request $request, array $jwt) {
+        $ip = $request->ip();
+        $userAgent = $request->header('User-Agent');
+        if (!array_key_exists('ipaddr', $jwt) || ! array_key_exists('user-agent', $jwt)) {
+            return false;
+        }
+        if($ip != $jwt['ipaddr'] || $userAgent != $jwt['user-agent']) {
+            return false;
+        }
+
+        return true;
+    }
+}

backend/app/Http/routes.php

@@ -25 +25 @@
  * address
  * showDirection
  */
-$app->get($apiUrlRoot.'devices', 'DeviceController@getDevice');
+$app->get($apiUrlRoot.'devices', [
+    'middleware' => 'jwtauth',
+    'uses' => 'DeviceController@getDevice'
+]);
 
-//$app->get($apiUrlRoot.'devices/all', 'DeviceController@getAll');
 
 /**
  * Parametry v url:
@@ -37 +39 @@
  * timeTo
  * direction
  */
-$app->get($apiUrlRoot.'devices/{id}', 'DeviceController@getDeviceById');
+$app->get($apiUrlRoot.'devices/{id}', [
+    'middleware' => 'jwtauth',
+    'uses' => 'DeviceController@getDeviceById'
+]);
+
 
 /**
  * Vrati vsechny typy aut.
  */
-$app->get($apiUrlRoot.'vehicles', 'VehicleController@getAll');
+$app->get($apiUrlRoot.'vehicles', [
+    'middleware' => 'jwtauth',
+    'uses' => 'VehicleController@getAll'
+]);
 
 /**
  * Vrati vsechna mesta.
  */
-$app->get($apiUrlRoot.'cities', 'LocationController@getCities');
+$app->get($apiUrlRoot.'cities', [
+    'middleware' => 'jwtauth',
+    'uses' => 'LocationController@getCities'
+]);
 
 /**
  * Vygeneruje novy JWT s omezenou platnosti.

backend/bootstrap/app.php

@@ -59 +59 @@
 |
 */
 
+$app->routeMiddleware([
+    'jwtauth' => App\Http\Middleware\JWTAuthenticate::class,
+]);
+
 // $app->middleware([
 //    App\Http\Middleware\ExampleMiddleware::class
 // ]);