daniel-cottone / cerberus

A demonstration of a completely stateless and RESTful token-based authorization system using JSON Web Tokens (JWT) and Spring Security.

██████╗███████╗██████╗ ██████╗ ███████╗██████╗ ██╗   ██╗███████╗
██╔════╝██╔════╝██╔══██╗██╔══██╗██╔════╝██╔══██╗██║   ██║██╔════╝
██║     █████╗  ██████╔╝██████╔╝█████╗  ██████╔╝██║   ██║███████╗
██║     ██╔══╝  ██╔══██╗██╔══██╗██╔══╝  ██╔══██╗██║   ██║╚════██║
╚██████╗███████╗██║  ██║██████╔╝███████╗██║  ██║╚██████╔╝███████║
╚═════╝╚══════╝╚═╝  ╚═╝╚═════╝ ╚══════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝

                            /\_/\____,
                  ,___/\_/\ \  ~     /
                  \     ~  \ )   XXX
                    XXX     /    /\_/\___,
                       \o-o/-o-o/   ~    /
                        ) /     \    XXX
                       _|    / \ \_/
                    ,-/   _  \_/   \
                   / (   /____,__|  )
                  (  |_ (    )  \) _|
                 _/ _)   \   \__/   (_
                (,-(,(,(,/      \,),),)

About

Cerberus is a demonstration of a completely stateless and RESTful token-based authorization system using JSON Web Tokens (JWT) and Spring Security.

Why?

For an API to be truly RESTful, no application state can be stored on the server itself. One particular challenge in implementing this is ensuring that your API is secure. Cerberus is the answer to this problem; access to the endpoints in the API requires a JSON Web Token to be present in the request header. This token is obtained by successfully performing an authentication request with the API, and afterwards this token will grant access to the API based on the authorities granted to the specified user.

Requirements

Cerberus requires Maven and Java 1.7 or greater.

Usage

To use start Cerberus, run in the terminal mvn spring-boot:run. Cerberus will now be running at http://localhost:8080/api/

There are two built-in user accounts to demonstrate the differing levels of access to the endpoints in the API:

User - user:password
Admin - admin:admin

Cerberus also has two endpoints. The first is the authentication endpoint, which is unrestricted. The second is a protected endpoint which only admin users may access (provided the correct JWT token is present in the request header):

/api/auth
/api/protected

To authenticate with Cerberus, you can curl a POST request with the following credentials to receive a JWT token:

curl -i -H "Content-Type: application/json" -X POST -d '{"username":"admin","password":"admin"}' http://localhost:8080/api/auth

The response should look like this:

{
  "token" : "eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiJ9.bKweskM-3QqOY8ScxhC9AcREOCG2UDY0Ylezdv1h81ALFg_v0QYBgxwfUjtf_Ns7RqAQIh_kFg1ZkeFV-szRUg"
}

You can now insert this token into your request header for GET access to /api/protected:

curl -i -H "Content-Type: application/json" -H "X-Auth-Token: eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhZG1pbiJ9.bKweskM-3QqOY8ScxhC9cREOCG2UDY0Ylezdv1h81ALFg_v0QYBgxwfUjtf_Ns7RqAQIh_kFg1ZkeFV-szRUg" -X GET http://localhost:8080/api/protected

You should get an HTTP 200 and the response :O

Tokens are configured to expire after a week. To ensure that a token remains fresh and does not expire, you can refresh an existing token by sending a GET to /api/auth/refresh with the token set in the request header. The response will be a new token with an updated expiration date. This refresh mechanism only works for tokens that have not expired yet, unless the token was provided to a mobile device. Tokens for mobile devices can always be refreshed.

Testing

To run Cerberus's unit tests, run in the terminal mvn clean package.

cerberus's Issues

How to deal with token expiration?

I think token expiration is a key feature that this project is lack of, here are some good discussions on Hacker News, https://news.ycombinator.com/item?id=8283006

The type io.jsonwebtoken.ExpiredJwtException cannot be resolved. It is indirectly referenced from required .class files

I import brahalla/Cerberus into sts IDE and getting the following error in com.ahancer.rr.security.TokenUtils, in which Claims object is not resolved.

CORS

Hi, i've been trying to run Cerberus with CORS activated. But seemingly there is nothing i can do to enable the Cross Domain. All the requests are being blocked.
Any Clue? =\

Enable SSL

where tokens are stored?

where tokens are stored?

http://localhost:8080/api/auth giving 401

hi,
I have checked out the code from master branch. set up project in eclipse and then started it.
i am using postman to test, when i try to hit "http://localhost:8080/api/auth"
i get access denied error though I should receive jwt token as mentioned in your README.MD.

Please help if possible. I have also attached screen shot for same.

How to access the claims in the protected controller

Thanks for the great project. Its really helpful. I have one last question. How do I access the token clains (e.g. username) in the protected controller?

I extended the dummy method a bit and got the username, but I wonder if there is a best practice to get the username in any controller method. Here is what I did:

public ResponseEntity<?> getDaHoney(HttpServletRequest request ) {

        String token = request.getHeader(this.tokenHeader);
        String username = this.tokenUtils.getUsernameFromToken(token);
        return ResponseEntity.ok(":O + " + username );
      }

SQL

CREATE TABLE users
(
id integer NOT NULL,
username character varying(50) NOT NULL,
password character varying(100) NOT NULL,
last_password_reset timestamp without time zone NOT NULL,
authorities character varying(100) NOT NULL,
CONSTRAINT user_pkey PRIMARY KEY (id)
);

Can't able to find "server.contextPath=/api" in the project A demonstration of a completely stateless and RESTful token-based authorization system using JSON Web Tokens (JWT) and Spring Security.

Whitelabel Error Page when using this http://localhost:8080/api/auth

The below message is occurs.............
This application has no explicit mapping for /error, so you are seeing this as a fallback.

Sat Jun 04 12:59:14 PDT 2016
There was an unexpected error (type=Method Not Allowed, status=405).
Request method 'GET' not supported

Sir, how can i solve this error???

The unit test AuthenticationControllerTest.requestingProtectedWithValidCredentialsReturnsExpected failed

Results :

Failed tests:
AuthenticationControllerTest.requestingProtectedWithValidCredentialsReturnsExpected:112
Expected: is "user"
but: was null

Tests run: 6, Failures: 1, Errors: 0, Skipped: 0

Can't able to find "server.contextPath=/api" in the project A demonstration of a completely stateless and RESTful token-based authorization system using JSON Web Tokens (JWT) and Spring Security.

sir,
i have installed postman tool in my chrome browser to interact with the url http://localhost:8080/api/.but the below error occurs.please give me a solution....

{
"timestamp": 1465412426695,
"status": 401,
"error": "Unauthorized",
"message": "Access Denied",
"path": "/api/"
}

How to change password? old token with new password

how to handle change password case? user want use old token with new password
Changing the secret key will revoke all user generated tokens

I dont want force user to log in again

the only idea is to generate a new token, but can I avoid it?

How to add new user?

I used:
https://www.bcrypt-generator.com/
and
new BCryptPasswordEncoder().encode("admin");

but password is incorrect

how to generate password?

How do I plug my own database in?

On com.brahalla.Cerberus.configuration.WebSecurityConfiguration there's the configureAuthentication method and it links it's Autowired userDetailsService attribute to Spring Boot's default AuthenticationManager builder.

This specific part is what is relative to each and every user of this project. Which means this is probably the part that needs changing every time this project is forked. It is unclear as to how to proceed with these motifications, taking in consideration Hibernate, JPA, DataSources, JDBC and so on.

I have a table of users on my database. I just want to check if the username and encoded password match a row in that database table to authenticate. How hard is that exactly can I do that?

Thanks

plugin problems

Failed to execute goal pl.project13.maven:git-commit-id-plugin:2.1.11:revision (default) on project Cerberus: .git directory could not be found! Please specify a valid [dotGitDirectory] in your pom.xml

how can I do this? I'm new to mvn...

Ok problem solved I had to get the sources using git. Now it's working

Compile error in line 109 of AuthenticationControllerTest.java

src/test/java/com/brahalla/Cerberus/integration/controller/rest/AuthenticationControllerTest.java:[109,28] non-static method getUsernameFromToken(java.lang.String) cannot be referenced from a static context

Logout functionality

Is there a way to log-out the user and invalidate the token?

token - Expiration and creation should have the same format

Expiration and creation should have the same format
"created": 1480505207432,
"exp": 1481110007