Added token verification

romanoff · romanoff · commit 8d37e61a9821 · 2016-05-22T12:22:08.000-07:00
diff --git a/plugins/jwt/jwt.go b/plugins/jwt/jwt.go
@@ -94,10 +94,13 @@ func (self *JWT) ProcessBeforeHook(data map[string]interface{}, r *http.Request)
 		return
 	}
 	headerValue = strings.Replace(headerValue, "Bearer ", "", 1)
-	//TODO: Verify secret
 	token, err := jws.ParseJWT([]byte(headerValue))
 	if err != nil {
 		return
 	}
+	err = token.Validate([]byte(self.Secret), crypto.SigningMethodHS256)
+	if err != nil {
+		return
+	}
 	data["jwt"] = token.Claims()
 }

Original file line number	Diff line number	Diff line change
`@@ -94,10 +94,13 @@ func (self JWT) ProcessBeforeHook(data map[string]interface{}, r http.Request)`
`94`	`94`	`return`
`95`	`95`	`}`
`96`	`96`	`headerValue = strings.Replace(headerValue, "Bearer ", "", 1)`
`97`		`- //TODO: Verify secret`
`98`	`97`	`token, err := jws.ParseJWT([]byte(headerValue))`
`99`	`98`	`if err != nil {`
`100`	`99`	`return`
`101`	`100`	`}`
	`101`	`+ err = token.Validate([]byte(self.Secret), crypto.SigningMethodHS256)`
	`102`	`+ if err != nil {`
	`103`	`+ return`
	`104`	`+ }`
`102`	`105`	`data["jwt"] = token.Claims()`
`103`	`106`	`}`