CODEWITHSUNDEEP
c#servicestackjwt
Werner
Werner

Reputation: 1311

How to issue and consume JWT using ServiceStack's JwtAuthProvider

Looking at the JwtAuthProvider documentation for ServiceStack, it seems that a lot of JWT functionality is given out-of-the-box. However I really need to look at some working example. I could not find any in the example directory for ServiceStack.

What I'd like to see, is an example code that shows:

  1. How to issue a token with some claims.
  2. How to decode the token and inspect the claims.

Just using some "Hello world" service. Does anyone have some code that shows this or know where to look?

Ideally, the signing would use RSA, but right now this is not that important...

Thanks.

Upvotes: 3

Views: 1636

Answers (1)

mythz
mythz

Reputation: 143369

The JWT AuthProvider is what Issues the JWT token which it populates based on the User Session. You can add your own metadata in the tokens and inspect it with the CreatePayloadFilter and PopulateSessionFilter.

JWT is enabled in both the AngularJS http://techstacks.io Example by just making a call to /session-to-token after the user successfully authenticates with their OAuth Provider, e.g:

$http.post("/session-to-token");

This converts their currently authenticated session into a JWT Token which it uses for future subsequent requests.

Likewise JWT is also used in http://gistlyn.com which uses a Customized JwtAuthProvider to embed the Github OAuth Access Token Secret into the JWT Token then uses the PopulateSessionFilter to extract it from the JWT Token and populate it back in the Users Session:

appHost.Plugins.Add(new AuthFeature(() => new AuthUserSession(),
new IAuthProvider[] {
    new GithubAuthProvider(appHost.AppSettings),
    //Use JWT so sessions survive across AppDomain restarts, redeployments, etc
    new JwtAuthProvider(appHost.AppSettings) 
    {
        CreatePayloadFilter = (payload, session) =>
        {
            var githubAuth = session.ProviderOAuthAccess.Safe()
                .FirstOrDefault(x => x.Provider == "github");
            payload["ats"] = githubAuth != null 
                ? githubAuth.AccessTokenSecret : null;
        },

        PopulateSessionFilter = (session, obj, req) => 
        {
            session.ProviderOAuthAccess = new List<IAuthTokens>
            {
                new AuthTokens { Provider = "github", AccessTokenSecret = obj["ats"] }
            };
        } 
    },
}));

Gistlyn uses a similar approach to TechStacks to using JWT Tokens by calling /session-to-token after the User has authenticated with Github OAuth using JavaScript's new fetch API

fetch("/session-to-token", { method:"POST", credentials:"include" });

JWT Stateless Auth Tests

For other examples you can look at JWT RSA Tests which uses CreateJwtPayload which shows examples of manually creating JWT Tokens in code.

Upvotes: 2

Related Questions