forked from GoogleIdTokenVerifier/GoogleIdTokenVerifier
-
Notifications
You must be signed in to change notification settings - Fork 0
/
googletokenidverifire.go
187 lines (166 loc) · 4.4 KB
/
googletokenidverifire.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
package GoogleIdTokenVerifier
import (
"bytes"
"crypto"
"crypto/rsa"
"crypto/sha256"
"encoding/base64"
"encoding/binary"
"encoding/json"
"errors"
"fmt"
"io"
"io/ioutil"
"log"
"math/big"
"net/http"
"strings"
"time"
)
type Certs struct {
Keys []keys `json:"keys"`
}
type keys struct {
Kty string `json:"kty"`
Alg string `json:"alg"`
Use string `json:"use"`
Kid string `json:"Kid"`
N string `json:"n"`
E string `json:"e"`
}
type TokenInfo struct {
Sub string `json:"sub"`
Email string `json:"email"`
AtHash string `json:"at_hash"`
Aud string `json:"aud"`
EmailVerified bool `json:"email_verified"`
Name string `json:"name"`
GivenName string `json:"given_name"`
FamilyName string `json:"family_name"`
Picture string `json:"picture"`
Local string `json:"locale"`
Iss string `json:"iss"`
Azp string `json:"azp"`
Iat int64 `json:"iat"`
Exp int64 `json:"exp"`
}
func Verify(authToken string, aud string) *TokenInfo {
return VerifyGoogleIDToken(authToken, GetCerts(GetCertsFromURL()), aud)
}
func VerifyGoogleIDToken(authToken string, certs *Certs, aud string) *TokenInfo {
header, payload, signature, messageToSign := divideAuthToken(authToken)
tokeninfo := getTokenInfo(payload)
var niltokeninfo *TokenInfo
if aud != tokeninfo.Aud {
err := errors.New("Token is not valid, Audience from token and certificate don't match")
fmt.Printf("Error verifying key %s\n", err.Error())
return niltokeninfo
}
if (tokeninfo.Iss != "accounts.google.com") && (tokeninfo.Iss != "https://accounts.google.com") {
err := errors.New("Token is not valid, ISS from token and certificate don't match")
fmt.Printf("Error verifying key %s\n", err.Error())
return niltokeninfo
}
if !checkTime(tokeninfo) {
err := errors.New("Token is not valid, Token is expired.")
fmt.Printf("Error verifying key %s\n", err.Error())
return niltokeninfo
}
key, err := choiceKeyByKeyID(certs.Keys, getAuthTokenKeyID(header))
if err != nil {
fmt.Printf("Error verifying key %s\n", err.Error())
return niltokeninfo
}
pKey := rsa.PublicKey{N: byteToInt(urlsafeB64decode(key.N)), E: btrToInt(byteToBtr(urlsafeB64decode(key.E)))}
err = rsa.VerifyPKCS1v15(&pKey, crypto.SHA256, messageToSign, signature)
if err != nil {
fmt.Printf("Error verifying key %s\n", err.Error())
return niltokeninfo
}
return tokeninfo
}
func getTokenInfo(bt []byte) *TokenInfo {
var a *TokenInfo
err := json.Unmarshal(bt, &a)
if err != nil {
log.Printf("token unmarshall error: %s", err.Error())
}
return a
}
func checkTime(tokeninfo *TokenInfo) bool {
if (time.Now().Unix() < tokeninfo.Iat) || (time.Now().Unix() > tokeninfo.Exp) {
return false
}
return true
}
func GetCertsFromURL() []byte {
res, _ := http.Get("https://www.googleapis.com/oauth2/v3/certs")
certs, _ := ioutil.ReadAll(res.Body)
res.Body.Close()
return certs
}
func GetCerts(bt []byte) *Certs {
var certs *Certs
err := json.Unmarshal(bt, &certs)
if err != nil {
log.Printf("certs unmarshall error: %s", err.Error())
}
return certs
}
func urlsafeB64decode(str string) []byte {
if m := len(str) % 4; m != 0 {
str += strings.Repeat("=", 4-m)
}
bt, _ := base64.URLEncoding.DecodeString(str)
return bt
}
func choiceKeyByKeyID(a []keys, tknkId string) (keys, error) {
if len(a) > 0 {
for _, key := range a {
if key.Kid == tknkId {
return key, nil
}
}
}
err := errors.New("token is not valid. There is no keyId or certificate doesn't match")
var b keys
return b, err
}
func getAuthTokenKeyID(bt []byte) string {
var a keys
err := json.Unmarshal(bt, &a)
if err != nil {
log.Printf("authToken unmarshall error: %s", err.Error())
return ""
}
return a.Kid
}
func divideAuthToken(str string) ([]byte, []byte, []byte, []byte) {
args := strings.Split(str, ".")
return urlsafeB64decode(args[0]), urlsafeB64decode(args[1]), urlsafeB64decode(args[2]), calcSum(args[0] + "." + args[1])
}
func byteToBtr(bt0 []byte) *bytes.Reader {
var bt1 []byte
if len(bt0) < 8 {
bt1 = make([]byte, 8-len(bt0), 8)
bt1 = append(bt1, bt0...)
} else {
bt1 = bt0
}
return bytes.NewReader(bt1)
}
func calcSum(str string) []byte {
a := sha256.New()
a.Write([]byte(str))
return a.Sum(nil)
}
func btrToInt(a io.Reader) int {
var e uint64
binary.Read(a, binary.BigEndian, &e)
return int(e)
}
func byteToInt(bt []byte) *big.Int {
a := big.NewInt(0)
a.SetBytes(bt)
return a
}