mirror of
https://github.com/cesanta/mongoose.git
synced 2026-10-08 08:54:54 +07:00
63 lines
1.4 KiB
Markdown
63 lines
1.4 KiB
Markdown
# JWT Bearer Authentication
|
|
|
|
## Build and run:
|
|
|
|
```sh
|
|
make
|
|
```
|
|
|
|
## HS256:
|
|
|
|
This path signs and verifies JWTs with the shared secret from `main.c`.
|
|
|
|
```sh
|
|
curl -i http://127.0.0.1:8000/login-hs256
|
|
TOKEN=$(curl -s http://127.0.0.1:8000/login-hs256 | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
|
|
curl -i -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/
|
|
```
|
|
|
|
```txt
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json
|
|
Content-Length: 47
|
|
|
|
{"sub":"admin","scope":"dash:read dash:write"}
|
|
```
|
|
|
|
`scope` here is a JSON string value containing a space-delimited permission list; as an example.
|
|
|
|
## ES256 (Requires MG_TLS_BUILTIN):
|
|
|
|
This path parses the EC private key from `main.c`, signs the JWT with it, and
|
|
derives the public key for verification to keep the example self-contained.
|
|
|
|
```sh
|
|
curl -i http://127.0.0.1:8000/login-es256
|
|
TOKEN=$(curl -s http://127.0.0.1:8000/login-es256 | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
|
|
curl -i -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/
|
|
```
|
|
|
|
```txt
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json
|
|
Content-Length: 36
|
|
|
|
{"sub":"admin","scope":"dash:read"}
|
|
```
|
|
|
|
`scope` here is a JSON string value containing a space-delimited permission list; as an example.
|
|
|
|
## Unauthorized access attempt example
|
|
|
|
```sh
|
|
curl -i -H "Authorization: Bearer bad.token.here" http://127.0.0.1:8000/
|
|
```
|
|
|
|
```txt
|
|
HTTP/1.1 401 Unauthorized
|
|
WWW-Authenticate: Bearer
|
|
Content-Length: 13
|
|
|
|
Unauthorized
|
|
```
|