naftulikay / rocket-oauth-jwt-demo Goto Github PK

In #1, we completed the login process by verifying the JWT token returned from Google.

Next, we need to issue our own JWT token and verify requests using that to complete the login flow. Ideally, we'd use asymmetric signing/verification, but for now we can start with HMAC SHA-256 with a symmetric key. Simply generate and return a JWT token from the key in the /oauth/success response, then use this token to make an authenticated request to a static API endpoint, e.g. /api/hello.

Presently, as of #1, we simply fetch the OAuth certificates in JSON form at the start of our service and never refresh them:

The certificates are in a simple HashMap<String, String> format in JSON at https://www.googleapis.com/oauth2/v1/certs.

• This resource also has an Expires header which we can use to determine when to refresh the token.
• tokio::time::sleep_until can be used with a single task to refresh the token before the resource expires.
• We can also set an upper bound on the refresh interval, making sure that we refresh the certificates at least once every 24 hours.
• We can use left_right as a concurrency primitive to implement lock-free reading of certificates for the very infrequent writes that will occur.

With this implemented, we can have a HTTP service that lives forever, updating the certificates whenever Google tells us that we should with a max refresh duration.