feat: support multiple extract token key

[ch3nnn]

Implement support for multiple custom token keys and simplify the JWT authentication configuration. WithTokenLookups function enables setting token keys, improving the authentication process by accommodating various token header extraction strategies. by accommodating various token header extraction strategies.

example:

jwt-api.api

syntax = "v1"


type Request {
	Name string `path:"name,options=you|me"`
}

type Response {
	Message string `json:"message"`
}

type FormExampleReq {
	Name string `form:"name,options=you|me"`
}

@server(
	jwt: Auth
	jwtTransition: Trans
)
service A-api {
	@handler GreetHandler
	get /greet/from/:name(Request) returns (Response)

	@handler FormExample
	post /form/example (FormExampleReq) returns (Response)
}

a-api.yaml

Name: A-api
Host: 0.0.0.0
Port: 8888

Auth:
  AccessSecret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  AccessExpire: 604800
  TokenLookup:
    - "header:Token"
    - "query:Token"
    - "form:Token"



Trans:
  Secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  PrevSecret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  TokenLookup:
    - "header:Token"
    - "query:Token"
    - "form:Token"

TokenLookup extract a jwt from custom request header or post form or get url arguments.

[codecov]

Codecov Report

Attention: Patch coverage is 95.55556% with 2 lines in your changes missing coverage. Please review.

Project coverage is 95.01%. Comparing base (8690859) to head (3e19023).
Report is 153 commits behind head on master.

Files with missing lines	Patch %	Lines
rest/token/tokenparser.go	90.90%	1 Missing and 1 partial ⚠️

Additional details and impacted files

Files with missing lines	Coverage Δ
rest/engine.go	100.00% <100.00%> (ø)
rest/handler/authhandler.go	87.75% <100.00%> (+2.84%)	⬆️
rest/server.go	97.43% <100.00%> (+0.90%)	⬆️
rest/token/tokenparser.go	92.40% <90.90%> (+0.62%)	⬆️

... and 253 files with indirect coverage changes

[kevwan]

Would you please give some examples on how to use different token keys? For example, how to request the API with curl.

[ch3nnn]

According to the a-api.yaml configuration file, the Auth.TokenLookup field is optional.

TokenLookup are attempted in sequence until a match is found; if no match occurs, the default Bearer auth request header is used.

example:

• url arguments

  curl --request GET \
    --url 'http://127.0.0.1:8888/greet/from/me?Token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3MjQ3NjUwMjR9.OvLg2ook9yVdBseQYkMO5wmdokYNGuaDMSa1dNkSeo8' \
    --header 'content-type: application/json'

• post form

  curl --request POST \
    --url http://localhost:8888/form/example \
    --header 'content-type: multipart/form-data' \
    --form Token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3MjQ3NjUwMjR9.OvLg2ook9yVdBseQYkMO5wmdokYNGuaDMSa1dNkSeo8 \
    --form name=me

• custom request header

  curl --request GET \
    --url http://127.0.0.1:8888/greet/from/me \
    --header 'content-type: application/json' \
    --header 'Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3MjQ3NjUwMjR9.OvLg2ook9yVdBseQYkMO5wmdokYNGuaDMSa1dNkSeo8'

If the setting TokenLookup is not provided, the default Bearer authorization request header will be used.

curl --request GET \
  --url http://127.0.0.1:8888/greet/from/me \
  --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3MjQ3NjUwMjR9.OvLg2ook9yVdBseQYkMO5wmdokYNGuaDMSa1dNkSeo8' \
  --header 'content-type: application/json'

[kevwan]

Bearer is the standard schema, is there any official spec that talks about Bearer replacement?

[ch3nnn]

I look up https://golang-jwt.github.io/jwt/#jwt-and-oauth-20 have mention a point

A JWT token is simply a signed JSON object. It can be used anywhere such a thing is useful.

This feature is also supported in other frameworks/libraries.

• golang-jwt/jwt https://github.com/golang-jwt/jwt/blob/main/request/extractor_example_test.go
• cloudwego/hertz https://www.cloudwego.io/zh/docs/hertz/tutorials/basic-feature/middleware/jwt/#tokenlookup
• labstack/echo https://github.com/labstack/echo/blob/master/middleware/jwt.go#L85
• gofiber/fiber https://github.com/gofiber/contrib/blob/18e5577b61e0227f4e6effcda28d1f106aab6d59/jwt/config.go#L61