dylan/vod-system
1
1
Fork 0
Code Issues 16 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

WIP: feat(security): implement refresh tokens #49

Closed
dylan wants to merge 25 commits from feat/add-refresh-tokens into master
pull from: feat/add-refresh-tokens
merge into: dylan:master
Conversation 1 Commits 25 Files Changed 26 +125 -104
3 changed files with 125 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 11115a435a - Show all commits

8
src/main/java/com/ddf/vodsystem/security/GoogleVerifierService.java
View File

@@ -25,12 +25,20 @@ public class GoogleVerifierService {
throw new NotAuthenticated("Invalid ID token: " + e.getMessage());
}
if (token == null) {
throw new NotAuthenticated("Invalid ID token");
}
String googleId = token.getPayload().getSubject();
if (googleId == null) {
throw new NotAuthenticated("Google ID does not exist");
}
if (!Boolean.TRUE.equals(token.getPayload().getEmailVerified())) {
throw new NotAuthenticated("Email not verified");
}
return new GoogleUser(
googleId,
token.getPayload().getEmail(),

150
src/main/java/com/ddf/vodsystem/security/TokenService.java
View File

@@ -1,88 +1,158 @@
package com.ddf.vodsystem.security;
import com.ddf.vodsystem.dto.properties.AuthProperties;
import com.ddf.vodsystem.entities.RefreshToken;
import com.ddf.vodsystem.entities.TokenFamily;
import com.ddf.vodsystem.entities.User;
import com.ddf.vodsystem.exceptions.NotAuthenticated;
import com.ddf.vodsystem.repositories.RefreshTokenRepository;
import com.ddf.vodsystem.repositories.TokenFamilyRepository;
import org.apache.commons.codec.binary.Hex;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.time.Duration;
import java.time.Instant;
import java.util.HexFormat;
import java.util.Optional;
@Service
public class TokenService {
private static final SecureRandom RNG = new SecureRandom();
private static final HexFormat HEX = HexFormat.of();
private final TokenFamilyRepository tokenFamilyRepository;
private final RefreshTokenRepository refreshTokenRepository;
private static final SecureRandom RNG = new SecureRandom();
private final HexFormat hex = HexFormat.of();
private final Duration tokenFamilyExpirationMs;
private final Duration refreshTokenExpirationMs;
private final Duration refreshGracePeriod;
public TokenService (
TokenFamilyRepository tokenFamilyRepository,
RefreshTokenRepository refreshTokenRepository
RefreshTokenRepository refreshTokenRepository,
AuthProperties props
) {
this.tokenFamilyRepository = tokenFamilyRepository;
this.refreshTokenRepository = refreshTokenRepository;
this.refreshTokenExpirationMs = props.expiration().refreshToken();
this.tokenFamilyExpirationMs = props.expiration().tokenFamily();
this.refreshGracePeriod = props.expiration().gracePeriod();
}
public TokenFamily createTokenFamily(User user, long expiryTimeMs) {
@Transactional
public String createSession(User user) {
Instant now = Instant.now();
TokenFamily tokenFamily = new TokenFamily();
tokenFamily.setUser(user);
tokenFamily.setCreatedAt(now);
tokenFamily.setExpiresAt(now.plusMillis(expiryTimeMs));
tokenFamily.setExpiresAt(now.plusMillis(tokenFamilyExpirationMs.toMillis()));
tokenFamilyRepository.save(tokenFamily);
return tokenFamilyRepository.saveAndFlush(tokenFamily);
byte[] token = generateRandomBytes(32);
createRefreshToken(
token,
tokenFamily
);
return HEX.formatHex(token);
}
public RefreshToken createRefreshToken(
@Transactional(noRollbackFor = NotAuthenticated.class)
public Rotation rotate(String hexToken) {
if (hexToken == null || hexToken.isBlank()) {
throw new NotAuthenticated("Missing refresh token");
}
byte[] hash;
try {
hash = sha256(HEX.parseHex(hexToken));
} catch (IllegalArgumentException e) {
throw new NotAuthenticated("Malformed refresh token");
}
Instant now = Instant.now();
// Check Token is real
RefreshToken refreshToken = refreshTokenRepository.findByHash(hash)
.orElseThrow(() -> new NotAuthenticated("No such refresh token"));
// Find Token Family
Optional<TokenFamily> tokenFamily = tokenFamilyRepository.findById(refreshToken.getTokenFamily().getId());
if (tokenFamily.isEmpty()) {
throw new IllegalStateException("Token must be tied to a family");
}
if (tokenFamily.get().getRevokedAt() != null) {
throw new NotAuthenticated("Token family has been revoked");
}
// Reuse Check
if (refreshToken.getUsedAt() != null) {
if (now.isAfter(refreshToken.getUsedAt().plus(refreshGracePeriod))) {
tokenFamily.get().setRevokedAt(Instant.now());
tokenFamilyRepository.save(tokenFamily.get());
}
throw new NotAuthenticated("Refresh token already being used");
}
// Expiry Check
if (
now.isAfter(refreshToken.getExpiresAt()) ||
now.isAfter(tokenFamily.get().getExpiresAt())
) {
throw new NotAuthenticated("Refresh token or family expired");
}
// Rotate
refreshToken.setUsedAt(now);
refreshTokenRepository.save(refreshToken);
byte[] newRawToken = generateRandomBytes(32);
createRefreshToken(
newRawToken,
tokenFamily.get()
);
return new Rotation(tokenFamily.get().getUser().getId(), HEX.formatHex(newRawToken));
}
public record Rotation(Long userId, String newRefreshToken) {}
private static byte[] sha256(byte[] in) {
try {
return MessageDigest.getInstance("SHA-256").digest(in);
} catch (NoSuchAlgorithmException e) {
throw new IllegalStateException(e);
}
}
private byte[] generateRandomBytes(int length) {
byte[] bytes = new byte[length];
RNG.nextBytes(bytes);
return bytes;
}
private RefreshToken createRefreshToken(
byte[] token,
TokenFamily tokenFamily,
long expiryTimeMs
TokenFamily tokenFamily
) {
Instant now = Instant.now();
RefreshToken refreshToken = new RefreshToken();
refreshToken.setTokenFamily(tokenFamily);
refreshToken.setTokenHash(hashToken(token));
refreshToken.setTokenHash(sha256(token));
refreshToken.setCreatedAt(now);
refreshToken.setExpiresAt(now.plusMillis(expiryTimeMs));
refreshToken.setExpiresAt(now.plusMillis(refreshTokenExpirationMs.toMillis()));
return refreshTokenRepository.saveAndFlush(refreshToken);
}
public Optional<RefreshToken> getRefreshTokenByHash(byte[] refreshHash) {
return refreshTokenRepository.findByHash(refreshHash);
}
public Optional<TokenFamily> getFamilyByRefreshToken(RefreshToken refreshToken) {
return tokenFamilyRepository.findById(refreshToken.getTokenFamily().getId());
}
public TokenFamily revokeTokenFamily(TokenFamily tokenFamily) {
tokenFamily.setRevokedAt(Instant.now());
return tokenFamilyRepository.saveAndFlush(tokenFamily);
}
public String bytesToHex(byte[] bytes) {
return hex.formatHex(bytes);
}
public byte[] hexToBytes(String hexS) {
return hex.parseHex(hexS);
}
public byte[] hashToken(byte[] token) {
try {
return MessageDigest.getInstance("SHA-256").digest(token); // 32 bytes
} catch (NoSuchAlgorithmException e) {
throw new IllegalStateException(e);
}
}
}

71
src/main/java/com/ddf/vodsystem/services/UserService.java
View File

@@ -2,9 +2,6 @@ package com.ddf.vodsystem.services;
import com.ddf.vodsystem.dto.GoogleUser;
import com.ddf.vodsystem.dto.TokenPackage;
import com.ddf.vodsystem.dto.properties.AuthProperties;
import com.ddf.vodsystem.entities.RefreshToken;
import com.ddf.vodsystem.entities.TokenFamily;
import com.ddf.vodsystem.entities.User;
import com.ddf.vodsystem.exceptions.NotAuthenticated;
import com.ddf.vodsystem.repositories.UserRepository;
@@ -17,7 +14,6 @@ import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Service;
import java.security.SecureRandom;
import java.time.Duration;
import java.time.Instant;
import java.util.HexFormat;
import java.util.Optional;
@@ -28,25 +24,17 @@ public class UserService {
private final UserRepository userRepository;
private final JwtService jwtService;
private final long tokenFamilyExpirationMs;
private final long refreshTokenExpirationMs;
private static final SecureRandom SECURE_RANDOM = new SecureRandom();
private static final int REFRESH_GRACE_PERIOD_SECONDS = 5;
private final TokenService tokenService;
public UserService(UserRepository userRepository,
JwtService jwtService,
GoogleVerifierService googleVerifierService,
AuthProperties props,
TokenService tokenService) {
this.userRepository = userRepository;
this.googleVerifierService = googleVerifierService;
this.jwtService = jwtService;
this.tokenService = tokenService;
this.refreshTokenExpirationMs = props.expiration().refreshToken().toMillis();
this.tokenFamilyExpirationMs = props.expiration().tokenFamily().toMillis();
}
/**
@@ -84,62 +72,17 @@ public class UserService {
GoogleUser googleUser = googleVerifierService.verify(idToken);
User user = createOrUpdateGoogleUser(googleUser);
byte[] rawRefresh = generateRandomBytes(32);
TokenFamily tokenFamily = tokenService.createTokenFamily(user, tokenFamilyExpirationMs);
tokenService.createRefreshToken(tokenService.hashToken(rawRefresh), tokenFamily, refreshTokenExpirationMs);
String refreshToken = tokenService.createSession(user);
String jwt = jwtService.generateToken(user.getId());
return new TokenPackage(tokenService.bytesToHex(rawRefresh), jwt);
return new TokenPackage(refreshToken, jwt);
}
@Transactional(noRollbackFor = NotAuthenticated.class)
public TokenPackage refresh(String refreshToken) {
if (refreshToken == null || refreshToken.isBlank()) {
throw new NotAuthenticated("Missing refresh token");
}
TokenService.Rotation rotation = tokenService.rotate(refreshToken);
String jwt = jwtService.generateToken(rotation.userId());
// Check Refresh Token is real
byte[] rawToken = tokenService.hexToBytes(refreshToken);
RefreshToken token = tokenService.getRefreshTokenByHash(rawToken)
.orElseThrow(() -> new NotAuthenticated("No such refresh token"));
// Find Token Family
Optional<TokenFamily> tokenFamily = tokenService.getFamilyByRefreshToken(token);
if (tokenFamily.isEmpty()) {
throw new IllegalStateException("Token must be tied to a family");
}
if (tokenFamily.get().getRevokedAt() != null) {
throw new NotAuthenticated("Token family has been revoked");
}
Instant now = Instant.now();
// Reuse Check
if (token.getUsedAt() != null) {
if (Duration.between(token.getUsedAt(), now).getSeconds() > REFRESH_GRACE_PERIOD_SECONDS) {
tokenService.revokeTokenFamily(tokenFamily.get());
}
throw new NotAuthenticated("Refresh token already used");
}
// Expiry Check
if (now.isAfter(token.getExpiresAt()) || now.isAfter(tokenFamily.get().getExpiresAt())) {
throw new NotAuthenticated("Refresh token or family expired");
}
// Rotate
token.setUsedAt(now);
byte[] newRawToken = generateRandomBytes(32);
tokenService.createRefreshToken(
newRawToken,
tokenFamily.get(),
refreshTokenExpirationMs
);
String jwt = jwtService.generateToken(tokenFamily.get().getUser().getId());
return new TokenPackage(tokenService.bytesToHex(newRawToken), jwt);
return new TokenPackage(rotation.newRefreshToken(), jwt);
}
/**
@@ -170,7 +113,7 @@ public class UserService {
user.setEmail(googleUser.email());
user.setName(googleUser.name());
user.setProfilePictureUrl(googleUser.profilePictureUrl());
return userRepository.saveAndFlush(user);
return userRepository.save(user);
}
private byte[] generateRandomBytes(int length) {