From df08a94bee7e8b8ba2accc4add443220d4532270 Mon Sep 17 00:00:00 2001 From: Sergey Matvienko Date: Fri, 19 Apr 2024 09:41:41 +0200 Subject: [PATCH] Revert "JWT factory immutable and test fixed with > 512bit key" This reverts commit 8dc455edc1a7531adc046d5c01cbdbc512bdd39b. --- .../security/model/token/JwtTokenFactory.java | 20 +++++++++---------- .../security/auth/JwtTokenFactoryTest.java | 2 +- 2 files changed, 10 insertions(+), 12 deletions(-) diff --git a/application/src/main/java/org/thingsboard/server/service/security/model/token/JwtTokenFactory.java b/application/src/main/java/org/thingsboard/server/service/security/model/token/JwtTokenFactory.java index f55f84e539..7270398c25 100644 --- a/application/src/main/java/org/thingsboard/server/service/security/model/token/JwtTokenFactory.java +++ b/application/src/main/java/org/thingsboard/server/service/security/model/token/JwtTokenFactory.java @@ -16,7 +16,6 @@ package org.thingsboard.server.service.security.model.token; import io.jsonwebtoken.Claims; -import io.jsonwebtoken.ClaimsBuilder; import io.jsonwebtoken.ExpiredJwtException; import io.jsonwebtoken.Jws; import io.jsonwebtoken.JwtBuilder; @@ -184,21 +183,20 @@ public class JwtTokenFactory { UserPrincipal principal = securityUser.getUserPrincipal(); - ClaimsBuilder claims = Jwts.claims() - .subject(principal.getValue()) - .add(USER_ID, securityUser.getId().getId().toString()) - .add(SCOPES, scopes); + Claims claims = Jwts.claims().setSubject(principal.getValue()).build(); + claims.put(USER_ID, securityUser.getId().getId().toString()); + claims.put(SCOPES, scopes); if (securityUser.getSessionId() != null) { - claims.add(SESSION_ID, securityUser.getSessionId()); + claims.put(SESSION_ID, securityUser.getSessionId()); } ZonedDateTime currentTime = ZonedDateTime.now(); return Jwts.builder() - .claims(claims.build()) - .issuer(jwtSettingsService.getJwtSettings().getTokenIssuer()) - .issuedAt(Date.from(currentTime.toInstant())) - .expiration(Date.from(currentTime.plusSeconds(expirationTime).toInstant())) + .setClaims(claims) + .setIssuer(jwtSettingsService.getJwtSettings().getTokenIssuer()) + .setIssuedAt(Date.from(currentTime.toInstant())) + .setExpiration(Date.from(currentTime.plusSeconds(expirationTime).toInstant())) .signWith(SignatureAlgorithm.HS512, jwtSettingsService.getJwtSettings().getTokenSigningKey()); } @@ -207,7 +205,7 @@ public class JwtTokenFactory { return Jwts.parser() .setSigningKey(jwtSettingsService.getJwtSettings().getTokenSigningKey()) .build() - .parseSignedClaims(token); + .parseClaimsJws(token); } catch (UnsupportedJwtException | MalformedJwtException | IllegalArgumentException ex) { log.debug("Invalid JWT Token", ex); throw new BadCredentialsException("Invalid JWT token: ", ex); diff --git a/application/src/test/java/org/thingsboard/server/service/security/auth/JwtTokenFactoryTest.java b/application/src/test/java/org/thingsboard/server/service/security/auth/JwtTokenFactoryTest.java index 44f7b53478..2d39dd9905 100644 --- a/application/src/test/java/org/thingsboard/server/service/security/auth/JwtTokenFactoryTest.java +++ b/application/src/test/java/org/thingsboard/server/service/security/auth/JwtTokenFactoryTest.java @@ -66,7 +66,7 @@ public class JwtTokenFactoryTest { public void beforeEach() { jwtSettings = new JwtSettings(); jwtSettings.setTokenIssuer("tb"); - jwtSettings.setTokenSigningKey("abewafaf".repeat(11)); //48*11 bits key > 512 bits + jwtSettings.setTokenSigningKey("abewafaf"); jwtSettings.setTokenExpirationTime((int) TimeUnit.HOURS.toSeconds(2)); jwtSettings.setRefreshTokenExpTime((int) TimeUnit.DAYS.toSeconds(7));