MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2024-12-24 06:05:55 -05:00
Code Issues Packages Projects Releases Wiki Activity

web: fix jwt token expiry set to one day by default. (#2819)

Browse Source 
Fixes #2818
This commit is contained in:
Bala FA 2016-10-05 10:18:55 -07:00 committed by Harshavardhana
parent 95f544657a
commit 63a7ca1af0
7 changed files with 19 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/auth-rpc-client.go
View File

@ -59,7 +59,7 @@ type RPCLoginReply struct {
// Validates if incoming token is valid.
func isRPCTokenValid(tokenStr string) bool {
jwt, err := newJWT(defaultTokenExpiry) // Expiry set to 100yrs.
jwt, err := newJWT(defaultInterNodeJWTExpiry)
if err != nil {
errorIf(err, "Unable to initialize JWT")
return false

2
cmd/controller-handlers.go
View File

@ -28,7 +28,7 @@ var errServerVersionMismatch = errors.New("Server versions do not match.")
// Login - login handler.
func (c *controllerAPIHandlers) LoginHandler(args *RPCLoginArgs, reply *RPCLoginReply) error {
jwt, err := newJWT(defaultTokenExpiry)
jwt, err := newJWT(defaultInterNodeJWTExpiry)
if err != nil {
return err
}

2
cmd/lock-rpc-server.go
View File

@ -141,7 +141,7 @@ func registerStorageLockers(mux *router.Router, lockServers []*lockServer) {
// LoginHandler - handles LoginHandler RPC call.
func (l *lockServer) LoginHandler(args *RPCLoginArgs, reply *RPCLoginReply) error {
jwt, err := newJWT(defaultTokenExpiry)
jwt, err := newJWT(defaultInterNodeJWTExpiry)
if err != nil {
return err
}

12
cmd/signature-jwt.go
View File

@ -30,11 +30,15 @@ const jwtAlgorithm = "Bearer"
// JWT - jwt auth backend
type JWT struct {
credential
expiry time.Duration
}
// Default each token expires in 100yrs.
const (
defaultTokenExpiry time.Duration = time.Hour * 876000 // 100yrs.
// Default JWT token for web handlers is one day.
defaultJWTExpiry time.Duration = time.Hour * 24
// Inter-node JWT token expiry is 100 years.
defaultInterNodeJWTExpiry time.Duration = time.Hour * 24 * 365 * 100
)
// newJWT - returns new JWT object.
@ -52,7 +56,7 @@ func newJWT(expiry time.Duration) (*JWT, error) {
return nil, errors.New("Invalid secret key")
}
return &JWT{cred}, nil
return &JWT{cred, expiry}, nil
}
// GenerateToken - generates a new Json Web Token based on the incoming access key.
@ -67,7 +71,7 @@ func (jwt *JWT) GenerateToken(accessKey string) (string, error) {
tUTCNow := time.Now().UTC()
token := jwtgo.NewWithClaims(jwtgo.SigningMethodHS512, jwtgo.MapClaims{
// Token expires in 10hrs.
"exp": tUTCNow.Add(defaultTokenExpiry).Unix(),
"exp": tUTCNow.Add(jwt.expiry).Unix(),
"iat": tUTCNow.Unix(),
"sub": accessKey,
})

6
cmd/signature-jwt_test.go
View File

@ -108,7 +108,7 @@ func TestNewJWT(t *testing.T) {
serverConfig.SetCredential(*testCase.cred)
}
_, err := newJWT(defaultWebTokenExpiry)
_, err := newJWT(defaultJWTExpiry)
if testCase.expectedErr != nil {
if err == nil {
@ -132,7 +132,7 @@ func TestGenerateToken(t *testing.T) {
}
defer removeAll(testPath)
jwt, err := newJWT(defaultWebTokenExpiry)
jwt, err := newJWT(defaultJWTExpiry)
if err != nil {
t.Fatalf("unable get new JWT, %s", err)
}
@ -179,7 +179,7 @@ func TestAuthenticate(t *testing.T) {
}
defer removeAll(testPath)
jwt, err := newJWT(defaultWebTokenExpiry)
jwt, err := newJWT(defaultJWTExpiry)
if err != nil {
t.Fatalf("unable get new JWT, %s", err)
}

2
cmd/storage-rpc-server.go
View File

@ -40,7 +40,7 @@ type storageServer struct {
// Login - login handler.
func (s *storageServer) LoginHandler(args *RPCLoginArgs, reply *RPCLoginReply) error {
jwt, err := newJWT(defaultTokenExpiry)
jwt, err := newJWT(defaultInterNodeJWTExpiry)
if err != nil {
return err
}

13
cmd/web-handlers.go
View File

@ -42,7 +42,7 @@ import (
// isJWTReqAuthenticated validates if any incoming request to be a
// valid JWT authenticated request.
func isJWTReqAuthenticated(req *http.Request) bool {
jwt, err := newJWT(defaultWebTokenExpiry)
jwt, err := newJWT(defaultJWTExpiry)
if err != nil {
errorIf(err, "unable to initialize a new JWT")
return false
@ -290,14 +290,9 @@ type LoginRep struct {
UIVersion string `json:"uiVersion"`
}
// Default JWT for minio browser expires in 24hrs.
const (
defaultWebTokenExpiry time.Duration = time.Hour * 24 // 24Hrs.
)
// Login - user login handler.
func (web *webAPIHandlers) Login(r *http.Request, args *LoginArgs, reply *LoginRep) error {
jwt, err := newJWT(defaultWebTokenExpiry)
jwt, err := newJWT(defaultJWTExpiry)
if err != nil {
return &json2.Error{Message: err.Error()}
}
@ -362,7 +357,7 @@ func (web *webAPIHandlers) SetAuth(r *http.Request, args *SetAuthArgs, reply *Se
return &json2.Error{Message: err.Error()}
}
jwt, err := newJWT(defaultWebTokenExpiry) // JWT Expiry set to 24Hrs.
jwt, err := newJWT(defaultJWTExpiry) // JWT Expiry set to 24Hrs.
if err != nil {
return &json2.Error{Message: err.Error()}
}
@ -447,7 +442,7 @@ func (web *webAPIHandlers) Download(w http.ResponseWriter, r *http.Request) {
object := vars["object"]
tokenStr := r.URL.Query().Get("token")
jwt, err := newJWT(defaultWebTokenExpiry) // Expiry set to 24Hrs.
jwt, err := newJWT(defaultJWTExpiry) // Expiry set to 24Hrs.
if err != nil {
errorIf(err, "error in getting new JWT")
return