Skip to content

Commit 33c8147

Browse files
tanya732tanya732
committed
Added headers in validateToken method
1 parent 1ca1e05 commit 33c8147

7 files changed

Lines changed: 44 additions & 34 deletions

File tree

‎auth0-api-java/src/main/java/com/auth0/AbstractAuthentication.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ protected AbstractAuthentication(JWTValidator jwtValidator, TokenExtractor extra
3030
*/
3131
protected DecodedJWT validateBearerToken(Map<String, String> headers, HttpRequestInfo httpRequestInfo) throws BaseAuthException {
3232
AuthToken authToken = extractor.extractBearer(headers);
33-
return jwtValidator.validateToken(authToken.getAccessToken(), httpRequestInfo);
33+
return jwtValidator.validateToken(authToken.getAccessToken(), headers, httpRequestInfo);
3434
}
3535

3636
/**
@@ -42,7 +42,7 @@ protected DecodedJWT validateDpopTokenAndProof(Map<String, String> headers, Http
4242
AuthValidatorHelper.validateHttpMethodAndHttpUrl(requestInfo);
4343

4444
AuthToken authToken = extractor.extractDPoPProofAndDPoPToken(headers);
45-
DecodedJWT decodedJwtToken = jwtValidator.validateToken(authToken.getAccessToken(), requestInfo);
45+
DecodedJWT decodedJwtToken = jwtValidator.validateToken(authToken.getAccessToken(), headers, requestInfo);
4646

4747
dpopProofValidator.validate(authToken.getProof(), decodedJwtToken, requestInfo);
4848

‎auth0-api-java/src/main/java/com/auth0/validators/JWTValidator.java‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import com.auth0.models.HttpRequestInfo;
1515

1616
import java.security.interfaces.RSAPublicKey;
17+
import java.util.Map;
1718

1819
import static com.auth0.jwt.JWT.require;
1920

@@ -66,7 +67,7 @@ public JWTValidator(AuthOptions authOptions, JwkProvider jwkProvider) {
6667
* @return the decoded and verified JWT
6768
* @throws BaseAuthException if validation fails
6869
*/
69-
public DecodedJWT validateToken(String token, HttpRequestInfo httpRequestInfo) throws BaseAuthException {
70+
public DecodedJWT validateToken(String token, Map<String, String> headers, HttpRequestInfo httpRequestInfo) throws BaseAuthException {
7071

7172
if (token == null || token.trim().isEmpty()) {
7273
throw new MissingRequiredArgumentException("access_token");
@@ -91,9 +92,9 @@ public DecodedJWT validateToken(String token, HttpRequestInfo httpRequestInfo) t
9192
/**
9293
* Validates a JWT and ensures all required scopes are present.
9394
*/
94-
public DecodedJWT validateTokenWithRequiredScopes(String token, HttpRequestInfo httpRequestInfo, String... requiredScopes)
95+
public DecodedJWT validateTokenWithRequiredScopes(String token, Map<String, String> headers, HttpRequestInfo httpRequestInfo, String... requiredScopes)
9596
throws BaseAuthException {
96-
DecodedJWT jwt = validateToken(token, httpRequestInfo);
97+
DecodedJWT jwt = validateToken(token, headers, httpRequestInfo);
9798
try {
9899
ClaimValidator.checkRequiredScopes(jwt, requiredScopes);
99100
return jwt;
@@ -105,9 +106,9 @@ public DecodedJWT validateTokenWithRequiredScopes(String token, HttpRequestInfo
105106
/**
106107
* Validates a JWT and ensures it has *any* of the provided scopes.
107108
*/
108-
public DecodedJWT validateTokenWithAnyScope(String token, HttpRequestInfo httpRequestInfo, String... scopes)
109+
public DecodedJWT validateTokenWithAnyScope(String token, Map<String, String> headers, HttpRequestInfo httpRequestInfo, String... scopes)
109110
throws BaseAuthException {
110-
DecodedJWT jwt = validateToken(token, httpRequestInfo);
111+
DecodedJWT jwt = validateToken(token, headers, httpRequestInfo);
111112
try {
112113
ClaimValidator.checkAnyScope(jwt, scopes);
113114
return jwt;
@@ -119,9 +120,9 @@ public DecodedJWT validateTokenWithAnyScope(String token, HttpRequestInfo httpRe
119120
/**
120121
* Validates a JWT and ensures a claim equals the expected value.
121122
*/
122-
public DecodedJWT validateTokenWithClaimEquals(String token, HttpRequestInfo httpRequestInfo, String claim, Object expected)
123+
public DecodedJWT validateTokenWithClaimEquals(String token, Map<String, String> headers, HttpRequestInfo httpRequestInfo, String claim, Object expected)
123124
throws BaseAuthException {
124-
DecodedJWT jwt = validateToken(token, httpRequestInfo);
125+
DecodedJWT jwt = validateToken(token, headers, httpRequestInfo);
125126
try {
126127
ClaimValidator.checkClaimEquals(jwt, claim, expected);
127128
return jwt;
@@ -133,9 +134,9 @@ public DecodedJWT validateTokenWithClaimEquals(String token, HttpRequestInfo htt
133134
/**
134135
* Validates a JWT and ensures a claim includes all expected values.
135136
*/
136-
public DecodedJWT validateTokenWithClaimIncludes(String token, HttpRequestInfo httpRequestInfo, String claim, Object... expectedValues)
137+
public DecodedJWT validateTokenWithClaimIncludes(String token, Map<String, String> headers, HttpRequestInfo httpRequestInfo, String claim, Object... expectedValues)
137138
throws BaseAuthException {
138-
DecodedJWT jwt = validateToken(token, httpRequestInfo);
139+
DecodedJWT jwt = validateToken(token, headers, httpRequestInfo);
139140
try {
140141
ClaimValidator.checkClaimIncludes(jwt, claim, expectedValues);
141142
return jwt;
@@ -144,9 +145,9 @@ public DecodedJWT validateTokenWithClaimIncludes(String token, HttpRequestInfo h
144145
}
145146
}
146147

147-
public DecodedJWT validateTokenWithClaimIncludesAny(String token, HttpRequestInfo httpRequestInfo, String claim, Object... expectedValues)
148+
public DecodedJWT validateTokenWithClaimIncludesAny(String token, Map<String, String> headers, HttpRequestInfo httpRequestInfo, String claim, Object... expectedValues)
148149
throws BaseAuthException {
149-
DecodedJWT jwt = validateToken(token, httpRequestInfo);
150+
DecodedJWT jwt = validateToken(token, headers, httpRequestInfo);
150151
try {
151152
ClaimValidator.checkClaimIncludesAny(jwt, claim, expectedValues);
152153
return jwt;

‎auth0-api-java/src/test/java/com/auth0/AbstractAuthenticationTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ public void validateBearerToken_shouldExtractAndValidate() throws Exception {
8080
DecodedJWT jwt = mock(DecodedJWT.class);
8181

8282
when(extractor.extractBearer(anyMap())).thenReturn(token);
83-
when(jwtValidator.validateToken("access", null)).thenReturn(jwt);
83+
when(jwtValidator.validateToken(eq("access"), anyMap(), any())).thenReturn(jwt);
8484

8585
Map<String, String> headers = new HashMap<>();
8686
headers.put("authorization", "Bearer access");
@@ -98,7 +98,7 @@ public void validateDpopTokenAndProof_shouldValidateEverything() throws Exceptio
9898
new HttpRequestInfo("GET", "https://api.example.com", null);
9999

100100
when(extractor.extractDPoPProofAndDPoPToken(anyMap())).thenReturn(token);
101-
when(jwtValidator.validateToken(eq("access"), any())).thenReturn(jwt);
101+
when(jwtValidator.validateToken(eq("access"), anyMap(), any())).thenReturn(jwt);
102102

103103
Map<String, String> headers = new HashMap<>();
104104
headers.put("authorization", "DPoP access");

‎auth0-api-java/src/test/java/com/auth0/AllowedDPoPAuthenticationTest.java‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,15 +47,19 @@ public void authenticate_shouldAcceptBearerToken() throws Exception {
4747
when(extractor.extractBearer(anyMap())).thenReturn(
4848
new AuthToken("token", null, null)
4949
);
50-
when(jwtValidator.validateToken("token", null)).thenReturn(jwt);
50+
51+
Map<String, String> normalizedHeaders = new HashMap<>();
52+
normalizedHeaders.put("authorization", "Bearer token");
53+
54+
when(jwtValidator.validateToken(eq("token"), eq(normalizedHeaders), any())).thenReturn(jwt);
5155

5256
Map<String, String> headers = new HashMap<>();
5357
headers.put("authorization", "Bearer token");
5458

5559
AuthenticationContext ctx = auth.authenticate(headers, null);
5660

5761
assertThat(ctx).isNotNull();
58-
verify(jwtValidator).validateToken("token", null);
62+
verify(jwtValidator).validateToken("token", normalizedHeaders, null);
5963
verifyNoInteractions(dpopProofValidator);
6064
}
6165

@@ -69,7 +73,7 @@ public void authenticate_shouldAcceptDpopToken() throws Exception {
6973
when(extractor.extractDPoPProofAndDPoPToken(anyMap())).thenReturn(
7074
new com.auth0.models.AuthToken("token", "proof", null)
7175
);
72-
when(jwtValidator.validateToken(eq("token"), any())).thenReturn(jwt);
76+
when(jwtValidator.validateToken(eq("token"), anyMap(), any())).thenReturn(jwt);
7377
Map<String, String> headers = new HashMap<>();
7478
headers.put("authorization", "DPoP token");
7579
headers.put("dpop", "proof");

‎auth0-api-java/src/test/java/com/auth0/DisabledDPoPAuthenticationTest.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,11 @@ public void authenticate_shouldAcceptBearerToken() throws Exception {
3333
when(extractor.extractBearer(anyMap())).thenReturn(
3434
new com.auth0.models.AuthToken("token", null, null)
3535
);
36-
when(jwtValidator.validateToken("token", null)).thenReturn(jwt);
36+
37+
Map<String, String> normalizedHeaders = new HashMap<>();
38+
normalizedHeaders.put("authorization", "Bearer token");
39+
40+
when(jwtValidator.validateToken(eq("token"), eq(normalizedHeaders), any())).thenReturn(jwt);
3741
Map<String, String> headers = new HashMap<>();
3842
headers.put("authorization", "Bearer token");
3943

@@ -43,7 +47,7 @@ public void authenticate_shouldAcceptBearerToken() throws Exception {
4347

4448

4549
assertThat(ctx).isNotNull();
46-
verify(jwtValidator).validateToken("token", null);
50+
verify(jwtValidator).validateToken("token", normalizedHeaders, null);
4751
}
4852

4953
@Test

‎auth0-api-java/src/test/java/com/auth0/RequiredDPoPAuthenticationTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ public void authenticate_shouldAcceptDpopToken() throws Exception {
3939
when(extractor.extractDPoPProofAndDPoPToken(anyMap())).thenReturn(
4040
new com.auth0.models.AuthToken("token", "proof", null)
4141
);
42-
when(jwtValidator.validateToken(eq("token"), any())).thenReturn(jwt);
42+
when(jwtValidator.validateToken(eq("token"), anyMap(), any())).thenReturn(jwt);
4343

4444
Map<String, String> headers = new HashMap<>();
4545
headers.put("authorization", "DPoP token");

‎auth0-api-java/src/test/java/com/auth0/validators/JWTValidatorTest.java‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import java.security.interfaces.RSAPrivateKey;
2020
import java.security.interfaces.RSAPublicKey;
2121
import java.util.Date;
22+
import java.util.HashMap;
2223

2324
import static org.assertj.core.api.Assertions.assertThat;
2425
import static org.mockito.ArgumentMatchers.anyString;
@@ -80,7 +81,7 @@ public void constructor_shouldRejectNullJwkProvider() {
8081
public void validateToken_success() throws Exception {
8182
String token = validToken();
8283

83-
DecodedJWT jwt = validator.validateToken(token, null);
84+
DecodedJWT jwt = validator.validateToken(token, null, null);
8485

8586
assertThat(jwt.getIssuer()).isEqualTo(ISSUER);
8687
assertThat(jwt.getAudience()).contains(AUDIENCE);
@@ -89,7 +90,7 @@ public void validateToken_success() throws Exception {
8990

9091
@Test(expected = MissingRequiredArgumentException.class)
9192
public void validateToken_shouldRejectNullToken() throws Exception {
92-
validator.validateToken(null, null);
93+
validator.validateToken(null, null, null);
9394
}
9495

9596
@Test(expected = VerifyAccessTokenException.class)
@@ -100,14 +101,14 @@ public void validateToken_shouldRejectInvalidSignature() throws Exception {
100101

101102
when(jwk.getPublicKey()).thenReturn(wrongKey);
102103

103-
validator.validateToken(validToken(), null);
104+
validator.validateToken(validToken(), null, null);
104105
}
105106

106107
@Test
107108
public void validateTokenWithRequiredScopes_success() throws Exception {
108109
String token = tokenWithScopes("read write");
109110

110-
DecodedJWT jwt = validator.validateTokenWithRequiredScopes(token, null, "read");
111+
DecodedJWT jwt = validator.validateTokenWithRequiredScopes(token, new HashMap<>(), null, "read");
111112

112113
assertThat(jwt).isNotNull();
113114
}
@@ -116,14 +117,14 @@ public void validateTokenWithRequiredScopes_success() throws Exception {
116117
public void validateTokenWithRequiredScopes_failure() throws Exception {
117118
String token = tokenWithScopes("read");
118119

119-
validator.validateTokenWithRequiredScopes(token, null, "admin");
120+
validator.validateTokenWithRequiredScopes(token, new HashMap<>(), null, "admin");
120121
}
121122

122123
@Test
123124
public void validateTokenWithAnyScope_success() throws Exception {
124125
String token = tokenWithScopes("read write");
125126

126-
DecodedJWT jwt = validator.validateTokenWithAnyScope(token, null, "admin", "write");
127+
DecodedJWT jwt = validator.validateTokenWithAnyScope(token, new HashMap<>(), null, "admin", "write");
127128

128129
assertThat(jwt).isNotNull();
129130
}
@@ -132,14 +133,14 @@ public void validateTokenWithAnyScope_success() throws Exception {
132133
public void validateTokenWithAnyScope_failure() throws Exception {
133134
String token = tokenWithScopes("read");
134135

135-
validator.validateTokenWithAnyScope(token, null, "admin");
136+
validator.validateTokenWithAnyScope(token, new HashMap<>(), null, "admin");
136137
}
137138

138139
@Test
139140
public void validateTokenWithClaimEquals_success() throws Exception {
140141
String token = tokenWithEmail("a@b.com");
141142

142-
DecodedJWT jwt = validator.validateTokenWithClaimEquals(token, null, "email", "a@b.com");
143+
DecodedJWT jwt = validator.validateTokenWithClaimEquals(token, new HashMap<>(), null, "email", "a@b.com");
143144

144145
assertThat(jwt).isNotNull();
145146
}
@@ -148,14 +149,14 @@ public void validateTokenWithClaimEquals_success() throws Exception {
148149
public void validateTokenWithClaimEquals_failure() throws Exception {
149150
String token = tokenWithEmail("a@b.com");
150151

151-
validator.validateTokenWithClaimEquals(token, null, "email", "x@y.com");
152+
validator.validateTokenWithClaimEquals(token, new HashMap<>(), null, "email", "x@y.com");
152153
}
153154

154155
@Test
155156
public void validateTokenWithClaimIncludes_success() throws Exception {
156157
String token = tokenWithScopes("read write");
157158

158-
DecodedJWT jwt = validator.validateTokenWithClaimIncludes(token, null, "scope", "read");
159+
DecodedJWT jwt = validator.validateTokenWithClaimIncludes(token, new HashMap<>(), null, "scope", "read");
159160

160161
assertThat(jwt).isNotNull();
161162
}
@@ -164,14 +165,14 @@ public void validateTokenWithClaimIncludes_success() throws Exception {
164165
public void validateTokenWithClaimIncludes_failure() throws Exception {
165166
String token = tokenWithScopes("read");
166167

167-
validator.validateTokenWithClaimIncludes(token, null, "scope", "admin");
168+
validator.validateTokenWithClaimIncludes(token, new HashMap<>(), null, "scope", "admin");
168169
}
169170

170171
@Test
171172
public void validateTokenWithClaimIncludesAny_success() throws Exception {
172173
String token = tokenWithScopes("read write");
173174

174-
DecodedJWT jwt = validator.validateTokenWithClaimIncludesAny(token, null, "scope", "admin", "write");
175+
DecodedJWT jwt = validator.validateTokenWithClaimIncludesAny(token, new HashMap<>(), null, "scope", "admin", "write");
175176

176177
assertThat(jwt).isNotNull();
177178
}
@@ -180,7 +181,7 @@ public void validateTokenWithClaimIncludesAny_success() throws Exception {
180181
public void validateTokenWithClaimIncludesAny_failure() throws Exception {
181182
String token = tokenWithScopes("read");
182183

183-
validator.validateTokenWithClaimIncludesAny(token, null, "scope", "admin");
184+
validator.validateTokenWithClaimIncludesAny(token, new HashMap<>(), null, "scope", "admin");
184185
}
185186

186187
@Test

0 commit comments

Comments
 (0)