Skip to content

Commit 06b717a

Browse files
chingor13chingor13
authored
feat: add TokenVerifier class that can verify RS256/ES256 tokens (#420)
* feat: add TokenVerifier class that can verify RS256/ES256 tokens * test: inject HttpTransportFactory for testing * test: inject HttpTransportFactory for testing * fix: use google-http-client for actual signature verification * chore: lint * test: split test into unit and integration Unit tests mock out the http request activity. Integration tests hit the live urls. * chore: lint * fix: return the JsonWebSignature instance on verify * test: remove IT test as the signature keys can/will change over time * docs: add javadoc for TokenVerifier * docs: add guide for verifying tokens in the README * chore: remove auto-value config changes * chore: tense, lower-case first word, no period * chore: run formatter * chore: more javadoc fixes * chore: remove line from README example * sample: add snippet showing check for additional claim * fix: remove default constructor - users should always use builder
1 parent 158d6da commit 06b717a

7 files changed

Lines changed: 795 additions & 0 deletions

File tree

‎google-auth-library-java/README.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,55 @@ Bigquery bq = new Bigquery.Builder(HTTP_TRANSPORT, JSON_FACTORY, requestInitiali
243243
.build();
244244
```
245245

246+
## Verifying JWT Tokens (Beta)
247+
248+
To verify a JWT token, use the [`TokenVerifier`][token-verifier] class.
249+
250+
### Verifying a Signature
251+
252+
To verify a signature, use the default [`TokenVerifier`][token-verifier]:
253+
254+
```java
255+
import com.google.api.client.json.webtoken.JsonWebSignature;
256+
import com.google.auth.oauth2.TokenVerifier;
257+
258+
TokenVerifier tokenVerifier = TokenVerifier.newBuilder().build();
259+
try {
260+
JsonWebSignature jsonWebSignature = tokenVerifier.verify(tokenString);
261+
// optionally verify additional claims
262+
if (!"expected-value".equals(jsonWebSignature.getPayload().get("additional-claim"))) {
263+
// handle custom verification error
264+
}
265+
} catch (TokenVerifier.VerificationException e) {
266+
// invalid token
267+
}
268+
```
269+
270+
### Customizing the TokenVerifier
271+
272+
To customize a [`TokenVerifier`][token-verifier], instantiate it via its builder:
273+
274+
```java
275+
import com.google.api.client.json.webtoken.JsonWebSignature;
276+
import com.google.auth.oauth2.TokenVerifier;
277+
278+
TokenVerifier tokenVerifier = TokenVerifier.newBuilder()
279+
.setAudience("audience-to-verify")
280+
.setIssuer("issuer-to-verify")
281+
.build();
282+
try {
283+
JsonWebSignature jsonWebSignature = tokenVerifier.verify(tokenString);
284+
// optionally verify additional claims
285+
if (!"expected-value".equals(jsonWebSignature.getPayload().get("additional-claim"))) {
286+
// handle custom verification error
287+
}
288+
} catch (TokenVerifier.VerificationException e) {
289+
// invalid token
290+
}
291+
```
292+
293+
For more options, see the [`TokenVerifier.Builder`][token-verifier-builder] documentation.
294+
246295
## CI Status
247296

248297
Java Version | Status
@@ -283,5 +332,7 @@ BSD 3-Clause - See [LICENSE](LICENSE) for more information.
283332
[apiary-clients]: https://search.maven.org/search?q=g:com.google.apis
284333
[http-credentials-adapter]: https://googleapis.dev/java/google-auth-library/latest/index.html?com/google/auth/http/HttpCredentialsAdapter.html
285334
[http-request-initializer]: https://googleapis.dev/java/google-http-client/latest/index.html?com/google/api/client/http/HttpRequestInitializer.html
335+
[token-verifier]: https://googleapis.dev/java/google-auth-library/latest/index.html?com/google/auth/oauth2/TokenVerifier.html
336+
[token-verifier-builder]: https://googleapis.dev/java/google-auth-library/latest/index.html?com/google/auth/oauth2/TokenVerifier.Builder.html
286337
[http-transport-factory]: https://googleapis.dev/java/google-auth-library/latest/index.html?com/google/auth/http/HttpTransportFactory.html
287338
[google-credentials]: https://googleapis.dev/java/google-auth-library/latest/index.html?com/google/auth/oauth2/GoogleCredentials.html

0 commit comments

Comments
 (0)