Skip to content
This repository was archived by the owner on Oct 14, 2021. It is now read-only.

Commit b15bdf4

Browse files
sgramponesgrampone
authored
Create new Signature verification methods (#36)
1 parent 211d630 commit b15bdf4

File tree

1 file changed

+118
-82
lines changed

1 file changed

+118
-82
lines changed

‎dotnet/dotnetframework/GeneXusJWT/JWT/JWTCreator.cs‎

Lines changed: 118 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-

1+
22
using GeneXusJWT.GenexusComons;
33
using GeneXusJWT.GenexusJWTClaims;
44
using GeneXusJWT.GenexusJWTUtils;
@@ -40,6 +40,7 @@ public JWTCreator() : base()
4040
[SecuritySafeCritical]
4141
public string DoCreate(string algorithm, PrivateClaims privateClaims, JWTOptions options)
4242
{
43+
this.error.cleanError();
4344
if (options.HasError())
4445
{
4546
this.error = options.GetError();
@@ -112,86 +113,23 @@ public string DoCreate(string algorithm, PrivateClaims privateClaims, JWTOptions
112113
return signedJwt;
113114
}
114115

115-
[SecuritySafeCritical]
116-
public bool DoVerify(string token, string expectedAlgorithm, PrivateClaims privateClaims, JWTOptions options)
117-
{
118-
if (options.HasError())
119-
{
120-
this.error = options.GetError();
121-
return false;
122-
}
123-
JWTAlgorithm expectedJWTAlgorithm = JWTAlgorithmUtils.getJWTAlgorithm(expectedAlgorithm, this.error);
124-
if (this.HasError())
125-
{
126-
return false;
127-
}
128-
129-
/***Hack to support 1024 RSA key lengths - BEGIN***/
130-
AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForVerifyingMap["RS256"] = 1024;
131-
AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForVerifyingMap["RS512"] = 1024;
132-
AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForVerifyingMap["RS384"] = 1024;
133-
/***Hack to support 1024 RSA key lengths - END***/
134-
135-
136-
JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
137-
JwtSecurityToken jwtToken = new JwtSecurityToken(token);
138-
139-
if (validateRegisteredClaims(jwtToken, options) && !isRevoqued(jwtToken, options) && verifyPrivateClaims(jwtToken, privateClaims, options) && VerifyHeader(jwtToken, options))
140-
{//if validates all registered claims and it is not on revocation list
141-
TokenValidationParameters parms = new TokenValidationParameters();
142-
parms.ValidateLifetime = false;
143-
parms.ValidateAudience = false;
144-
parms.ValidateIssuer = false;
145-
parms.ValidateActor = false;
146-
JWTAlgorithm alg = JWTAlgorithmUtils.getJWTAlgorithm_forVerification(jwtToken.Header.Alg, this.error);
147-
if (this.HasError())
148-
{
149-
return false;
150-
}
151-
if (JWTAlgorithmUtils.getJWTAlgorithm(jwtToken.Header.Alg, this.error) != expectedJWTAlgorithm || this.HasError())
152-
{
153-
this.error.setError("JW008", "Expected algorithm does not match token algorithm");
154-
return false;
155-
}
156-
SecurityKey genericKey = null;
157-
if (JWTAlgorithmUtils.isPrivate(alg))
158-
{
159-
160-
161-
CertificateX509 cert = options.GetCertificate();
162-
if (cert.HasError())
163-
{
164-
this.error = cert.GetError();
165-
return false;
166-
}
167-
RsaSecurityKey publicKey = new RsaSecurityKey((RSA)cert.getPublicKeyXML());
168-
genericKey = publicKey;
169-
}
170-
else
171-
{
172-
SymmetricSecurityKey symKey = new SymmetricSecurityKey(options.getSecret());
173-
genericKey = symKey;
174-
}
175-
176-
SigningCredentials signingCredentials = JWTAlgorithmUtils.getSigningCredentials(alg, genericKey, this.error);
177-
parms.IssuerSigningKey = genericKey;
178-
SecurityToken validatedToken;
179-
try
180-
{
181-
handler.ValidateToken(token, parms, out validatedToken);
182-
}
183-
catch (Exception e)
184-
{
185-
this.error.setError("JW004", e.Message);
186-
187-
return false;
188-
}
189-
return true;
116+
[SecuritySafeCritical]
117+
public bool DoVerify(String token, String expectedAlgorithm, PrivateClaims privateClaims, JWTOptions options)
118+
{
119+
return DoVerify(token, expectedAlgorithm, privateClaims, options, true, true);
120+
}
190121

191-
}
192-
return false;
122+
[SecuritySafeCritical]
123+
public bool DoVerifyJustSignature(String token, String expectedAlgorithm, JWTOptions options)
124+
{
125+
return DoVerify(token, expectedAlgorithm, null, options, false, false);
126+
}
193127

194-
}
128+
[SecuritySafeCritical]
129+
public bool DoVerifySignature(String token, String expectedAlgorithm, JWTOptions options)
130+
{
131+
return DoVerify(token, expectedAlgorithm, null, options, false, true);
132+
}
195133

196134
[SecuritySafeCritical]
197135
public string GetPayload(string token)
@@ -214,9 +152,107 @@ public string GetTokenID(string token)
214152
}
215153

216154

217-
/******** EXTERNAL OBJECT PUBLIC METHODS - END ********/
218-
219-
private JwtPayload doBuildPayload(PrivateClaims privateClaims, JWTOptions options)
155+
/******** EXTERNAL OBJECT PUBLIC METHODS - END ********/
156+
157+
[SecuritySafeCritical]
158+
private bool DoVerify(string token, string expectedAlgorithm, PrivateClaims privateClaims, JWTOptions options, bool verifyClaims, bool verifyRegClaims)
159+
{
160+
this.error.cleanError();
161+
if (options.HasError())
162+
{
163+
this.error = options.GetError();
164+
return false;
165+
}
166+
JWTAlgorithm expectedJWTAlgorithm = JWTAlgorithmUtils.getJWTAlgorithm(expectedAlgorithm, this.error);
167+
if (this.HasError())
168+
{
169+
return false;
170+
}
171+
172+
/***Hack to support 1024 RSA key lengths - BEGIN***/
173+
AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForVerifyingMap["RS256"] = 1024;
174+
AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForVerifyingMap["RS512"] = 1024;
175+
AsymmetricSignatureProvider.DefaultMinimumAsymmetricKeySizeInBitsForVerifyingMap["RS384"] = 1024;
176+
/***Hack to support 1024 RSA key lengths - END***/
177+
178+
179+
JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
180+
JwtSecurityToken jwtToken = new JwtSecurityToken(token);
181+
if(isRevoqued(jwtToken, options))
182+
{
183+
return false;
184+
}
185+
if(verifyRegClaims)
186+
{
187+
if(!validateRegisteredClaims(jwtToken, options))
188+
{
189+
return false;
190+
}
191+
}
192+
if(verifyClaims)
193+
{
194+
if(!verifyPrivateClaims(jwtToken, privateClaims, options) || !VerifyHeader(jwtToken, options))
195+
{
196+
return false;
197+
}
198+
}
199+
//if validates all registered claims and it is not on revocation list
200+
TokenValidationParameters parms = new TokenValidationParameters();
201+
parms.ValidateLifetime = false;
202+
parms.ValidateAudience = false;
203+
parms.ValidateIssuer = false;
204+
parms.ValidateActor = false;
205+
JWTAlgorithm alg = JWTAlgorithmUtils.getJWTAlgorithm_forVerification(jwtToken.Header.Alg, this.error);
206+
if (this.HasError())
207+
{
208+
return false;
209+
}
210+
if (JWTAlgorithmUtils.getJWTAlgorithm(jwtToken.Header.Alg, this.error) != expectedJWTAlgorithm || this.HasError())
211+
{
212+
this.error.setError("JW008", "Expected algorithm does not match token algorithm");
213+
return false;
214+
}
215+
SecurityKey genericKey = null;
216+
if (JWTAlgorithmUtils.isPrivate(alg))
217+
{
218+
219+
220+
CertificateX509 cert = options.GetCertificate();
221+
if (cert.HasError())
222+
{
223+
this.error = cert.GetError();
224+
return false;
225+
}
226+
RsaSecurityKey publicKey = new RsaSecurityKey((RSA)cert.getPublicKeyXML());
227+
genericKey = publicKey;
228+
}
229+
else
230+
{
231+
SymmetricSecurityKey symKey = new SymmetricSecurityKey(options.getSecret());
232+
genericKey = symKey;
233+
}
234+
235+
SigningCredentials signingCredentials = JWTAlgorithmUtils.getSigningCredentials(alg, genericKey, this.error);
236+
parms.IssuerSigningKey = genericKey;
237+
SecurityToken validatedToken;
238+
try
239+
{
240+
handler.ValidateToken(token, parms, out validatedToken);
241+
}
242+
catch (Exception e)
243+
{
244+
this.error.setError("JW004", e.Message);
245+
246+
return false;
247+
}
248+
return true;
249+
250+
251+
252+
}
253+
254+
255+
private JwtPayload doBuildPayload(PrivateClaims privateClaims, JWTOptions options)
220256
{
221257
JwtPayload payload = new JwtPayload();
222258
// ****START BUILD PAYLOAD****//

0 commit comments

Comments
 (0)