JWT-foundations.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Utility functions"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "import base64\n",
    "import json\n",
    "\n",
    "\n",
    "def b64urlencode(s):\n",
    "    return base64.urlsafe_b64encode(s).rstrip(b'=')\n",
    "\n",
    "\n",
    "def b64urldecode(s):\n",
    "    remainder = len(s) % 4\n",
    "    if remainder == 2:\n",
    "        s += b'=='\n",
    "    elif remainder == 3:\n",
    "        s += b'='\n",
    "    elif remainder == 1:\n",
    "        raise ValueError(\"Illegal base64 string.\")\n",
    "    else:\n",
    "        assert remainder == 0, \"Math is wrong.\"\n",
    "    return base64.urlsafe_b64decode(s)\n",
    "\n",
    "\n",
    "def compact_json(data):\n",
    "    return json.dumps(data, separators=(',', ':')).encode()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Encoding a JWS"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "from Crypto.Hash import HMAC, SHA256\n",
    "\n",
    "\n",
    "def encode(payload, secret):\n",
    "    header = {'typ': 'JWT', 'alg': 'HS256'}\n",
    "    protected = serialize(header, payload)\n",
    "    signature = sign(secret, protected)\n",
    "    return b'.'.join([protected, signature])\n",
    "\n",
    "\n",
    "def serialize(header, payload):\n",
    "    header = b64urlencode(compact_json(header))\n",
    "    payload = b64urlencode(compact_json(payload))\n",
    "    return b'.'.join([header, payload])\n",
    "\n",
    "\n",
    "def sign(secret, data):\n",
    "    hmac = HMAC.new(secret.encode(), data, digestmod=SHA256)\n",
    "    return b64urlencode(hmac.digest())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "token = encode({'iss': 'figo', 'exp': 1604103133}, 'the-secret')\n",
    "token.split(b'.')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Decoding a JWS"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "def decode(token, secret):\n",
    "    protected, header, payload, signature = deserialize(token)\n",
    "    verify(secret, protected, header, signature)\n",
    "    return payload\n",
    "\n",
    "\n",
    "def deserialize(token):\n",
    "    if token.count(b'.') != 2:\n",
    "        raise ValueError(\"Invalid token format.\")\n",
    "    protected, signature = token.rsplit(b'.', 1)\n",
    "    header, payload = protected.split(b'.')\n",
    "    return (\n",
    "        protected,\n",
    "        json.loads(b64urldecode(header)),\n",
    "        json.loads(b64urldecode(payload)),\n",
    "        b64urldecode(signature))\n",
    "            \n",
    "    \n",
    "def verify(secret, protected, header, signature):    \n",
    "    if header['alg'] != 'HS256':\n",
    "        raise ValueError(\"Invalid signing algorithm.\")\n",
    "    hmac = HMAC.new(secret.encode(), protected, digestmod=SHA256)\n",
    "    if signature != hmac.digest():\n",
    "        raise ValueError(\"Invalid signature.\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "decode(token, 'the-secret')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "try:\n",
    "    decode(token, 'foo')\n",
    "except ValueError as e:\n",
    "    print(e)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "_, header, payload, signature = deserialize(token)\n",
    "payload['iss'] = 'alice'\n",
    "altered_token = b'.'.join([serialize(header, payload), b64urlencode(signature)])\n",
    "\n",
    "try:\n",
    "    decode(altered_token, 'the-secret')\n",
    "except ValueError as e:\n",
    "    print(e)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Library support\n",
    "\n",
    "There are many libraries for different programming languages available. See [jwt.io](https://jwt.io/)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from jose import jwt\n",
    "\n",
    "jwt.decode(token, 'the-secret')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "try:\n",
    "    jwt.decode(altered_token, 'the-secret')\n",
    "except jwt.JWTError as e:\n",
    "    print(e)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import time\n",
    "\n",
    "token = jwt.encode({'exp': int(time.time())}, 'the-secret')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "try:\n",
    "    jwt.decode(token, 'the-secret')\n",
    "except jwt.JWTError as e:\n",
    "    print(e)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.2"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}