2
1
mirror of https://github.com/Thream/socketio-jwt.git synced 2024-07-21 09:38:31 +02:00

added ability to enforce only header authorization versus query string authorization - DK/MW

This commit is contained in:
Mathew Woods 2016-10-20 11:13:23 -05:00 committed by Fabian Arndt
parent 2d390e66e6
commit ef0983a702
3 changed files with 90 additions and 45 deletions

View File

@ -158,7 +158,14 @@ function authorize(options, onConnection) {
} }
} }
//get the token from handshake or query string // Check if the header has to include authentication
if (options.auth_header_required && !token) {
return auth.fail(new UnauthorizedError('missing_authorization_header', {
message: 'Server requires Authorization Header'
}), data, accept);
}
// Get the token from handshake or query string
if (handshake && handshake.query.token){ if (handshake && handshake.query.token){
token = handshake.query.token; token = handshake.query.token;
} }

View File

@ -33,6 +33,7 @@
"serve-static": "^1.12.1", "serve-static": "^1.12.1",
"jsonwebtoken": "^8.3.0", "jsonwebtoken": "^8.3.0",
"xtend": "~2.1.2", "xtend": "~2.1.2",
"q": "^1.4.1",
"server-destroy": "~1.0.1", "server-destroy": "~1.0.1",
"should": "~11.2.1", "should": "~11.2.1",
"socket.io": "^1.7.3", "socket.io": "^1.7.3",

View File

@ -1,46 +1,84 @@
var Q = require('q');
var fixture = require('./fixture'); var fixture = require('./fixture');
var request = require('request'); var request = require('request');
var io = require('socket.io-client'); var io = require('socket.io-client');
describe('authorizer', () => { describe('authorizer', () => {
//start and stop the server
before(done => { fixture.start({ }, done) });
after(fixture.stop);
describe('authorizer all auth types allowed', () => { describe('when the user is not logged in', function () {
it('should emit error with unauthorized handshake', function (done){
var socket = io.connect('http://localhost:9000?token=boooooo', {
'forceNew': true
});
//start and stop the server socket.on('error', function(err){
before(done => { err.message.should.eql("jwt malformed");
fixture.start({ }, done) err.code.should.eql("invalid_token");
socket.close();
done();
});
}); });
after(fixture.stop);
describe('when the user is not logged in', function () { });
it('should emit error with unauthorized handshake', function (done){ describe('when the user is logged in', function() {
var socket = io.connect('http://localhost:9000?token=boooooo', { before(function (done) {
'forceNew': true request.post({
url: 'http://localhost:9000/login',
form: { username: 'jose', password: 'Pa123' },
json: true
}, function (err, resp, body) {
this.token = body.token;
done();
}.bind(this));
});
describe('authorizer disallows query string token when specified in startup options', () => {
before(done => {
Q.ninvoke(fixture, 'stop')
.then(() => Q.ninvoke(fixture, 'start', { auth_header_required: true }))
.done(done);
})
after(done => {
Q.ninvoke(fixture, 'stop')
.then(() => Q.ninvoke(fixture, 'start', { }))
.done(done);
})
it('auth headers are supported', function (done){
var socket = io.connect('http://localhost:9000', {
'forceNew':true,
'extraHeaders': {'Authorization': `Bearer ${this.token}`}
}); });
socket.on('connect', function(){
socket.close();
done();
}).on('error', done);
});
it('auth token in query string is disallowed', function (done){
var socket = io.connect('http://localhost:9000', {
'forceNew':true,
'query': 'token=' + this.token
});
socket.on('error', function(err){ socket.on('error', function(err){
err.message.should.eql("jwt malformed"); err.message.should.eql("Server requires Authorization Header");
err.code.should.eql("invalid_token"); err.code.should.eql("missing_authorization_header");
socket.close(); socket.close();
done(); done();
}); });
}); });
})
}); describe('authorizer all auth types allowed', () => {
before(done => {
describe('when the user is logged in', function() { Q.ninvoke(fixture, 'stop')
.then(() => Q.ninvoke(fixture, 'start', {}))
before(function (done) { .done(done);
request.post({ })
url: 'http://localhost:9000/login',
form: { username: 'jose', password: 'Pa123' },
json: true
}, function (err, resp, body) {
this.token = body.token;
done();
}.bind(this));
});
it('auth headers are supported', function (done){ it('auth headers are supported', function (done){
var socket = io.connect('http://localhost:9000', { var socket = io.connect('http://localhost:9000', {
@ -64,27 +102,26 @@ describe('authorizer', () => {
}).on('error', done); }).on('error', done);
}); });
}); });
});
describe('unsgined token', function() { describe('unsgined token', function() {
beforeEach(function () { beforeEach(function () {
this.token = 'eyJhbGciOiJub25lIiwiY3R5IjoiSldUIn0.eyJuYW1lIjoiSm9obiBGb28ifQ.'; this.token = 'eyJhbGciOiJub25lIiwiY3R5IjoiSldUIn0.eyJuYW1lIjoiSm9obiBGb28ifQ.';
});
it('should not do the handshake and connect', function (done){
var socket = io.connect('http://localhost:9000', {
'forceNew':true,
'query': 'token=' + this.token
});
socket.on('connect', function () {
socket.close();
done(new Error('this shouldnt happen'));
}).on('error', function (err) {
socket.close();
err.message.should.eql("jwt signature is required");
done();
});
});
}); });
it('should not do the handshake and connect', function (done){
var socket = io.connect('http://localhost:9000', {
'forceNew':true,
'query': 'token=' + this.token
});
socket.on('connect', function () {
socket.close();
done(new Error('this shouldnt happen'));
}).on('error', function (err) {
socket.close();
err.message.should.eql("jwt signature is required");
done();
});
});
}); });
}); });