jwt-blacklist

withsection.erl

jwt_authentication_handler(Req) ->
  case header_value(Req, "Authorization") of
    "Bearer " ++ Token -> 
      try
        ensure_safe_token(Token, couch_config:get("jwt_auth_blacklist")),
        token_auth_user(Req, decode(Token))
      catch
        % return generic error message (https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Authentication_Responses)
        throw:_ -> throw({unauthorized, <<"Token rejected">>});
        error:_ -> throw({unauthorized, <<"Token rejected">>})
      end;
    _ -> Req
  end.

ensure_safe_token(Token, Config) ->
  case couch_util:get_value(Token, Config) of
    undefined -> true;
    Reason -> throw(Reason)
  end.


-define (BlacklistConfig, [{"token","bad guy 1"}]).


ensure_safe_token_ok_test() ->
  ?assertEqual(true, ensure_safe_token("good token", ?BlacklistConfig)).

ensure_safe_token_unsafe_test() ->
  ?assertThrow("bad guy 1", ensure_safe_token("token", ?BlacklistConfig)).