JWT add different subject depending on the data in the body

Question

I've been asked to generate a token depending on the username that is asking for it. Now I'm creating a token just with a single subject but I don't know how to change the subject dinamically before creating the token depending on the body of the request.

This is what I've done so far to generate a token with a single subject: The service class:

@Component
@RequiredArgsConstructor
public class JwtService {

    @Value("${issuer}")
    private String issuer;
    @Value("${kid}")
    private String keyId;
    @Value("#{'${audience}'.split(',')}")
    private List<String> audiences;
    @Value("#{'${subject}'.split(',')}")
    private List<String> subject;

    private final JwtKeyProvider jwtKeyProvider;

    public String generateToken() throws JoseException {
       
        JwtClaims claims = new JwtClaims();
        claims.setIssuer(issuer);
        claims.setAudience(Lists.newArrayList(audiences));
        claims.setExpirationTimeMinutesInTheFuture(60);
        claims.setJwtId(keyId);
        claims.setIssuedAtToNow();
        claims.setNotBeforeMinutesInThePast(0);
        claims.setSubject(subject);
     
        JsonWebSignature jws = new JsonWebSignature();

        jws.setPayload(claims.toJson());

        jws.setHeader("typ", "JWT");

        jws.setKey(jwtKeyProvider.getPrivateKey());
        jws.setKeyIdHeaderValue(keyId);
        jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256);
        
        String jwt = jws.getCompactSerialization();
        return jwt;
    }
}

And the controller:

@RestController
@RequiredArgsConstructor
public class JWTController {

    private final JwtService jwtService;

    @PostMapping("/getToken")
    public ResponseEntity getJwt(@RequestBody JwtRequest request) throws JoseException {
            return ResponseEntity.ok(
                    JwtResponse.builder()
                            .token(jwtService.generateToken())
                            .build()
            );
    }
}

I could do it doing like this:

 @PostMapping("/getToken")
        public ResponseEntity getJwt(@RequestBody JwtRequest request) throws JoseException {
                return ResponseEntity.ok(
                        JwtResponse.builder()
                                .token(jwtService.generateToken(request.getUsername()))
                                .build()
                );
        }
    }

But I don't want to send any parameters in the generateToken function as I would have to change a lot of code then.

To resume I want to assign to the subject the value of the username that is sent in the body. So is there a way in the JwtService class to receive that username and set as the subject after?

Thanks in advance!

I have multiple username that can create token. These usernames are also the subjects of the token, so at the end I want to reflect the value of that subject depending on the value of the username — DiegoMG, Jul 22 '22 at 09:45
just pass in username from the request into your function and set it as the subject? i dont see the problem here — Toerktumlare, Jul 22 '22 at 09:51

Georglider · Answer 1 · 2022-07-22T11:16:50.533

0

First you need to put whitelist=user1,user2 in your application.properties, because sometimes names might trigger as system variables (for example username does)

Then in JWTController you need to check if not user equals, but contains in list

    @Value("#{'${whitelist}'.split(',')}")
    private List<String> whitelist;

    @PostMapping("/getToken")
    public ResponseEntity<?> getJwt(@RequestBody JwtRequest request) throws JoseException {
        if(whitelist.contains(request.username())) {
            return ResponseEntity.ok(
                    JwtResponse.builder()
                            .token(jwtService.generateToken(request.username()))
                            .build()
            );
        } else {
            return ResponseEntity.ok("Invalid username");
        }
    }

In your JWTService you need to set JWT Subject to username which passed through whitelist

claims.setSubject(username);

And finally you need to do JSON request to server

{
    "username": "user2"
}

edited Jul 22 '22 at 11:16

answered Jul 22 '22 at 10:03

Georglider

52
6

this code is very dangerous as with this code anyone can set any value as the subject in the token. Do not use this code. – Toerktumlare Jul 22 '22 at 10:05
That's why Im using a List of subjects that are the same as the username, so If the username pass in the body belongs to that list, it has to generate the token with that valid username/subject – DiegoMG Jul 22 '22 at 10:14
@Toerktumlare I've just noticed that there's no password check. Thank you – Georglider Jul 22 '22 at 10:14
It doesn't have a password. Im creating the token from a private key – DiegoMG Jul 22 '22 at 10:15
@DiegoMG I don't really understand how it supposed to work – Georglider Jul 22 '22 at 10:17
the person asking is not very clear in his question, but what it looks like is that he has a defined "whitelist" of users that can be set as subject. So what he wants is that the username should be checked against this list, if and only if the user is in that list it should be set as subject. – Toerktumlare Jul 22 '22 at 10:17
Yes that's exaclty what I need! – DiegoMG Jul 22 '22 at 10:18
I've update the Q, hope its clearer now! – DiegoMG Jul 22 '22 at 10:24
@DiegoMG can you please include your application.properties or where you have this list to test it – Georglider Jul 22 '22 at 10:42
@Georglider I've updated the question. At the end you'll find the values of the app.prop – DiegoMG Jul 22 '22 at 10:47
@Georglider Is there a way to avoid passing as a parameter that username in JwtService? – DiegoMG Jul 29 '22 at 13:54
@DiegoMG Well, I think you could try generating something random as username value – Georglider Jul 29 '22 at 18:11

JWT add different subject depending on the data in the body

1 Answers1