Repository navigation
Conversation
A valid signature is not enough to admit a device. The token must
also be meant for this gateway's project, current, and within its
issuer's limits.
Check the audience (a string or a list) and the times, with 30
seconds of leeway: "exp" and "iat" are required whole numbers, "exp"
must come after "iat", "iat" may not be in the future, and "nbf" is
checked when present. The lifetime, from "iat" to "exp", must be
within the issuer's maximum, so a token without "iat" is refused.
Claims the issuer requires must be present as exact string values,
and "sub", when present, must be a string. The jsonwebtoken crate
requires only "exp" and checks neither "iat" nor the lifetime, so
these checks are the gateway's own. Each issuer needs an issuer, an
audience and a positive maximum lifetime. A token that names a key in
"cnf" is refused, because a bearer token cannot prove it holds that
key.
An issuer can require a token ID ("jti"), a string of 1 to 256 bytes.
A token that carries one is accepted once: its ID is recorded only
after every other check passes, and kept until the token expires.
The record holds at most 100,000 IDs. When it is full, expired IDs
are dropped, and if it is still full, a token carrying an ID is
refused. The ID is released when the admission it was recorded for
does not complete, so a device can retry with the same token. A
token without an ID can be presented again until it expires.
Refusals carry fixed reasons and never any token content.
Tests cover each refusal, including a token without "iat", one whose
"exp" does not come after "iat", and malformed "jti" and "sub"
values.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A token with a valid signature must also be meant for this gateway's project, current, and within its issuer's limits.
This checks the audience, the token's times with 30 seconds of leeway, the issuer's maximum lifetime and required claim values, and accepts a token that carries an ID only once.
An ID can be released when the admission it was recorded for does not complete, so a device can retry with the same token. When the record of IDs is full, further tokens carrying one are refused until entries expire.
Depends on
Stacked on the signature verification pull request.
Test plan
Related to datum-cloud/enhancements#883 and datum-cloud/enhancements#916