root
/
libauth
mirror of https://github.com/therootcompany/libauth.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

feat: update error messages

This commit is contained in:
AJ ONeal 2023-04-04 17:22:57 -06:00
parent 0c2f482c9e
commit 1dece66bee
Signed by: coolaj86
GPG Key ID: 585419CA6DB0AA23
2 changed files with 12 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
chiauth/chiauth.go
View File

@ -51,34 +51,28 @@ func NewTokenVerifier(opts VerificationParams) func(http.Handler) http.Handler {
return return
} }
http.Error( errmsg := "bad format: missing 'Authorization' header and 'access_token' query"
w, http.Error(w, errmsg, http.StatusBadRequest)
"Bad Format: missing Authorization header and 'access_token' query",
http.StatusBadRequest,
)
return return
} }
parts := strings.Split(token, " ") parts := strings.Split(token, " ")
if len(parts) != 2 { if len(parts) != 2 {
http.Error( errmsg := "bad format: expected 'Authorization' header to be in the format of 'Bearer <Token>'"
w, http.Error(w, errmsg, http.StatusBadRequest)
"Bad Format: expected Authorization header to be in the format of 'Bearer <Token>'",
http.StatusBadRequest,
)
return return
} }
token = parts[1] token = parts[1]
inspected, err := libauth.VerifyJWT(token, opts.Issuers, r) inspected, err := libauth.VerifyJWT(token, opts.Issuers, r)
if nil != err { if nil != err {
w.WriteHeader(http.StatusBadRequest) errmsg := "invalid token: " + err.Error()
errmsg := "Invalid Token: " + err.Error() + "\n" http.Error(w, errmsg, http.StatusBadRequest)
w.Write([]byte(errmsg))
return return
} }
if !inspected.Trusted { if !inspected.Trusted {
http.Error(w, "Bad Token Signature", http.StatusBadRequest) errmsg := "invalid token: bad signature"
http.Error(w, errmsg, http.StatusBadRequest)
return return
} }

8
libauth.go
View File

@ -68,7 +68,7 @@ func ParseIssuerListString(issuerList string) []string {
func VerifyJWT(jwt string, issuers IssuerList, r *http.Request) (*JWS, error) { func VerifyJWT(jwt string, issuers IssuerList, r *http.Request) (*JWS, error) {
jws := keypairs.JWTToJWS(jwt) jws := keypairs.JWTToJWS(jwt)
if nil == jws { if nil == jws {
return nil, fmt.Errorf("bad request: malformed Authorization header") return nil, fmt.Errorf("bad request: bearer token could not be parsed from 'Authorization' header")
} }
myJws := &JWS{ myJws := &JWS{
@ -97,14 +97,14 @@ func VerifyJWS(jws *JWS, issuers IssuerList, r *http.Request) (*JWS, error) {
return nil, fmt.Errorf("bad request: missing 'kid' identifier") return nil, fmt.Errorf("bad request: missing 'kid' identifier")
} else if !issOK || len(iss) == 0 { } else if !issOK || len(iss) == 0 {
//errs = append(errs, "payload.iss must exist to complement header.kid") //errs = append(errs, "payload.iss must exist to complement header.kid")
return nil, fmt.Errorf("bad request: payload.iss must exist to complement header.kid") return nil, fmt.Errorf("bad request: 'payload.iss' must exist to complement 'header.kid'")
} else { } else {
// TODO beware domain fronting, we should set domain statically // TODO beware domain fronting, we should set domain statically
// See https://pkg.go.dev/git.rootprojects.org/root/keypairs@v0.6.2/keyfetch // See https://pkg.go.dev/git.rootprojects.org/root/keypairs@v0.6.2/keyfetch
// (Caddy does protect against Domain-Fronting by default: // (Caddy does protect against Domain-Fronting by default:
// https://github.com/caddyserver/caddy/issues/2500) // https://github.com/caddyserver/caddy/issues/2500)
if !issuers.IsTrustedIssuer(iss, r) { if !issuers.IsTrustedIssuer(iss, r) {
return nil, fmt.Errorf("bad request: 'iss' is not a trusted issuer") return nil, fmt.Errorf("unauthorized: 'iss' (%s) is not a trusted issuer", iss)
} }
} }
var err error var err error
@ -123,7 +123,7 @@ func VerifyJWS(jws *JWS, issuers IssuerList, r *http.Request) (*JWS, error) {
jws.Errors = append(jws.Errors, err) jws.Errors = append(jws.Errors, err)
strs = append(strs, err.Error()) strs = append(strs, err.Error())
} }
return jws, fmt.Errorf("invalid jwt:\n%s", strings.Join(strs, "\n\t")) return jws, fmt.Errorf("invalid jwt:\n\t%s", strings.Join(strs, "\n\t"))
} }
jws.Trusted = true jws.Trusted = true