OAuth徹底入門 セキュアな認可システムを適用するための原則と実践

nosql.one().make(function(builder) {
  builder.where('access_token', inToken);
  builder.callback(function(err, token) {
    if (token) {
      console.log("We found a matching token: %s", inToken);
    } else {
      console.log('No matching token was found.');
    };
    req.access_token = token;
    next();
    return;
  });
});

var getClient = function(clientId) {
  return __.find(clients, function(client) {
    return client.client_id == clientId;
  });
};

nosql.one().make(function(builder) {
  builder.where('refresh_token', req.body.refresh_token);
  builder.callback(function(err, token) {
    if (token) {
      対象のリフレッシュ・トークンが存在する場合の処理を行う
    } else {
      res.status(400).json({error: 'invalid_grant'});
      return;
    }
  });
});

if (token.client_id != clientId) {
  nosql.remove().make(function(builder) {
    builder.where('refresh_token', req.body.refresh_token);
  });
  res.status(400).json({error: 'invalid_grant'});
  return;
}

var protectedResource = 'http://localhost:9002/resource';

window.onload = function() {
   if (!client.client_id) {
    $.ajax({
      url: authServer.registrationEndpoint,
      type: 'POST',
      data: client,
      crossDomain: true,
      dataType: 'json'
    }).done(function(data) {
      client.client_id = data.client_id;
      client.client_secret = data.client_secret;
    }).fail(function() {
      $('.oauth-protected-resource')
          .text('Error while fetching registration endpoint');
    });
  }
}

var form_data = qs.stringify({
  grant_type: 'authorization_code',
  code: code,
  redirect_uri: client.redirect_uri,
  code_verifier: code_verifier
});

// 先ほどまでのすべての整合性チェックはこのif文内で行われる
if (jose.jws.JWS.verify(
    inToken,
    Buffer.from(sharedTokenSecret).toString('hex'),
    [header.alg])) {
  …略
}

var inToken = req.body.token;
console.log('Introspecting token %s', inToken);
nosql.one().make(function(builder) {
  builder.where('access_token', inToken);
  builder.callback(function(err, token) {
    if (token) {
      var introspectionResponse = {
        active: true,
        iss: 'http://localhost:9001/',
        aud: 'http://localhost:9002/',
        sub: token.user ? token.user.sub : undefined,
        username: token.user ? token.user.preferred_username : undefined,
        scope: token.scope ? token.scope.join(' ') : undefined,
        client_id: token.client_id
      };
      res.status(200).json(introspectionResponse);
      return;
    } else {
      var introspectionResponse = {
        active: false
      };
      res.status(200).json(introspectionResponse);
      return;
    }
  });
});

var inToken = req.body.token;
nosql.remove().make(function(builder) {
  builder.and();
  builder.where('access_token', inToken);
  builder.where('client_id', clientId);
  builder.callback(function(err, count) {
    console.log("Removed %s tokens", count);
    res.status(204).end();
    return;
  });
});

nosql.remove().make(function(builder) {
  builder.where('client_id', clientId);
  builder.callback(function(err, count) {
    console.log("Removed %s tokens", count);
  });
});

res.status(204).end();
return;

var getAccessToken = function(req, res, next) {
  var inToken = null;
  var auth = req.headers['authorization'];
  if (auth && auth.toLowerCase().indexOf('bearer') == 0) {
    inToken = auth.slice('bearer '.length);
  } else if (req.body && req.body.access_token) {
    inToken = req.body.access_token;
  } else if (req.query && req.query.access_token) {
    inToken = req.query.access_token
  }

  console.log('Incoming token: %s', inToken);

  nosql.one().make(function(builder) {
    builder.where('access_token', inToken);
    builder.callback(function(err, token) {
      if (token) {
        console.log("We found a matching token: %s", inToken);
      } else {
        console.log('No matching token was found.');
      };
      req.access_token = token;
      next();
      return;
    });
  });
};

} else if (req.body.grant_type == 'refresh_token') {
  nosql.one().make(function(builder) {
    builder.where('refresh_token', req.body.refresh_token);
    builder.callback(function(err, token) {
      if (token) {
        console.log("We found a matching refresh token: %s",
            req.body.refresh_token);

        if (token.client_id != clientId) {
          nosql.remove().make(function(builder) {
            builder.where('refresh_token', req.body.refresh_token);
          });
          res.status(400).json({error: 'invalid_grant'});
          return;
        }

        var access_token = randomstring.generate();

        nosql.insert({
          access_token: access_token,
          client_id: clientId
        });

        var token_response = {
          access_token: access_token,
          token_type: 'Bearer',
          refresh_token: token.refresh_token
        };

        res.status(200).json(token_response);
        return;
      } else {
        console.log('No matching token was found.');
        res.status(400).json({error: 'invalid_grant'});
        return;
      }
    });
  });
} else if …略

app.post('/introspect', function(req, res) {
  var auth = req.headers['authorization'];
  var resourceCredentials = decodeClientCredentials(auth);
  var resourceId = resourceCredentials.id;
  var resourceSecret = resourceCredentials.secret;
  var resource = getProtectedResource(resourceId);

  if (!resource) {
    console.log('Unknown resource %s', resourceId);
    res.status(401).end();
    return;
  }

  if (resource.resource_secret != resourceSecret) {
    console.log('Mismatched secret, expected %s got %s',
        resource.resource_secret, resourceSecret);
    res.status(401).end();
    return;
  }

  var inToken = req.body.token;

  console.log('Introspecting token %s', inToken);

  nosql.one().make(function(builder) {
    builder.where('access_token', inToken);
    builder.callback(function(err, token) {
      if (token) {
        console.log("We found a matching token: %s", inToken);

        var introspectionResponse = {
          active: true,
          iss: 'http://localhost:9001/',
          aud: 'http://localhost:9002/',
          sub: token.user ? token.user.sub : undefined,
          username: token.user ? token.user.preferred_username : undefined,
          scope: token.scope ? token.scope.join(' ') : undefined,
          client_id: token.client_id
        };

        res.status(200).json(introspectionResponse);
        return;
      } else {
        console.log('No matching token was found.');

        var introspectionResponse = {
          active: false
        };

        res.status(200).json(introspectionResponse);
        return;
      }
    });
  });
});

app.post('/revoke', function(req, res) {
  var auth = req.headers['authorization'];
  if (auth) {
    // Authorizationヘッダーをチェック
    var clientCredentials = decodeClientCredentials(auth);
    var clientId = clientCredentials.id;
    var clientSecret = clientCredentials.secret;
  }

  // ない場合はPOST送信されたボディーをチェック
  if (req.body.client_id) {
    if (clientId) {
      // すでにAuthorizationヘッダーにクライアントのクレデンシャルがある場合はエラー
      console.log('Client attempted to authenticate with multiplemethods');
      res.status(401).json({error: 'invalid_client'});
      return;
    }

    var clientId = req.body.client_id;
    var clientSecret = req.body.client_secret;
  }

  var client = getClient(clientId);
  if (!client) {
    console.log('Unknown client %s', clientId);
    res.status(401).json({error: 'invalid_client'});
    return;
  }

  if (client.client_secret != clientSecret) {
    console.log('Mismatched client secret, expected %s got %s',
        client.client_secret, clientSecret);
    res.status(401).json({error: 'invalid_client'});
    return;
  }

  var inToken = req.body.token;
  nosql.remove().make(function(builder) {
    builder.and();
    builder.where('access_token', inToken);
    builder.where('client_id', clientId);
    builder.callback(function(err, count) {
      console.log("Removed %s tokens", count);
      res.status(204).end();
      return;
    });
  });
});