ring

clarice 2019-11-11T08:37:35.028900Z

Hi there, are any of you able to help me with the following https://stackoverflow.com/questions/58797701/why-are-my-endpoints-not-passing-headers-cookies-across-and-responding-as-expect?

seancorfield 2019-11-11T18:40:55.029700Z

@cbillowes A similar question popped up here about a week ago and I said https://clojurians.slack.com/archives/C0A5GSC6T/p1572893708023900

2019-11-11T18:52:04.033800Z

I did post over on #clojure but perhaps my question was a tad specific, and thought it might fit better in this channel. Is there any Ring middleware or similar that can validate OAuth2 / OpenId Connect JWT’s for resource servers? I can always build my own middleware wrapping something like Okta’s JwtVerifier, but I’d have thought there was a fair bit of demand for oauth2 securing microservices etc. In particular, I’m looking for functionality similar to the following code which, based on issuer pulls down the Authentication Server’s public keys and checks signature:

AccessTokenVerifier jwtVerifier = JwtVerifiers.accessTokenVerifierBuilder()
                .setIssuer("<https://domain.okta.com/oauth2/default>")
                .setAudience("<api://default>")                // defaults to '<api://default>'
                .setConnectionTimeout(Duration.ofSeconds(1)) // defaults to 1s
                .setReadTimeout(Duration.ofSeconds(1))       // defaults to 1s
                .build();
        try {
            Jwt jwt = jwtVerifier.decode("jwt-token-here");
            System.out.print(jwt.getClaims().get("upn"));
        } catch (JwtVerificationException e) {
            e.printStackTrace();
        }