79 lines
2.4 KiB
Go
79 lines
2.4 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"ExpiryDatesManager/server/utils"
|
|
"strings"
|
|
"ExpiryDatesManager/server/model"
|
|
jwt "github.com/dgrijalva/jwt-go"
|
|
"os"
|
|
)
|
|
|
|
var JwtAuthentication = func(next http.Handler) http.Handler {
|
|
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
notAuth := []string{"/api/register", "/api/login", "/static", "/", ""} //List of endpoints that doesn't require auth
|
|
requestPath := r.URL.Path //current request path
|
|
|
|
if !strings.HasPrefix(requestPath, "/api") {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
//check if request does not need authentication, serve the request if it doesn't need it
|
|
for _, value := range notAuth {
|
|
|
|
if value == requestPath {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
}
|
|
|
|
response := make(map[string] interface{})
|
|
tokenHeader := r.Header.Get("Authorization") //Grab the token from the header
|
|
|
|
if tokenHeader == "" { //Token is missing, returns with error code 403 Unauthorized
|
|
response = utils.Message(false, "Missing auth token")
|
|
w.WriteHeader(http.StatusForbidden)
|
|
w.Header().Add("Content-Type", "application/json")
|
|
utils.Respond(w, response)
|
|
return
|
|
}
|
|
|
|
splitted := strings.Split(tokenHeader, " ") //The token normally comes in format `Bearer {token-body}`, we check if the retrieved token matched this requirement
|
|
if len(splitted) != 2 {
|
|
response = utils.Message(false, "Invalid/Malformed auth token")
|
|
w.WriteHeader(http.StatusForbidden)
|
|
w.Header().Add("Content-Type", "application/json")
|
|
utils.Respond(w, response)
|
|
return
|
|
}
|
|
|
|
tokenPart := splitted[1] //Grab the token part, what we are truly interested in
|
|
tk := &model.Token{}
|
|
|
|
token, err := jwt.ParseWithClaims(tokenPart, tk, func(token *jwt.Token) (interface{}, error) {
|
|
return []byte(os.Getenv("token_password")), nil
|
|
})
|
|
|
|
if err != nil { //Malformed token, returns with http code 403 as usual
|
|
response = utils.Message(false, "Malformed authentication token")
|
|
w.WriteHeader(http.StatusForbidden)
|
|
w.Header().Add("Content-Type", "application/json")
|
|
utils.Respond(w, response)
|
|
return
|
|
}
|
|
|
|
if !token.Valid { //Token is invalid, maybe not signed on this server
|
|
response = utils.Message(false, "Token is not valid.")
|
|
w.WriteHeader(http.StatusForbidden)
|
|
w.Header().Add("Content-Type", "application/json")
|
|
utils.Respond(w, response)
|
|
return
|
|
}
|
|
|
|
//Everything went well, proceed with the request
|
|
next.ServeHTTP(w, r) //proceed in the middleware chain!
|
|
});
|
|
} |