Git Product home page Git Product logo

sparkjava-jwt's Introduction

sparkjava-jwt

Example SparkJava - JWT integration

tech

Public available endpoints

ENDPOINT HTTP METHOD PARAMS DESCRIPTION
/auth/register POST JSON body mandatory fields: userName, password. Additional fields firstName, secondName New user registration
/auth/login POST JSON body mandatory fields: userName, password User login

Additional JWT endpoints

HTTP Header: Authorization: Bearer JWTToken

ENDPOINT HTTP METHOD PARAMS DESCRIPTION
/auth/token POST JWT token refresh
/auth/logout POST JWT token revocation
/auth/me GET User details

Roles

Predefined user roles:

  • ADMIN
  • MANAGER
  • DEVELOPER

Endpoints for Role management:

ENDPOINT HTTP METHOD PARAMS DESCRIPTION
/auth/roles POST JSON body mandatory fields: userName, role Add new Role to user
/auth/roles DELETE JSON body mandatory fields: userName, role Revoke Role from User

Admin user

Predefined Admin user (admin/admin)

Additional

Cron job (every minute) to clean up revoked JWT Tokens

sparkjava-jwt's People

Contributors

rjozefowicz avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar

Forkers

bleach1606 mjablecnik guyoguyes gastonestol rsantaeulalia

sparkjava-jwt's Issues

BCrypt salt should be random for each request

There's a problem with your usage of JBCrypt. The salt should be generated at random for each request, that's the whole point of it.

sparkjava-jwt/src/main/java/com/r6lab/sparkjava/jwt/controller/AuthController.java

Line 34 in 89e3d10

private static final String BCRYPT_SALT = BCrypt.gensalt();

Also, you should be checking passwords using the checkpw() method.

sparkjava-jwt/src/main/java/com/r6lab/sparkjava/jwt/controller/AuthController.java

Line 150 in 89e3d10

String encryptedPassword = BCrypt.hashpw(jsonRequest.get(PASSWORD_PROPERTY).getAsString(), BCRYPT_SALT);

You won't notice it with this in-memory "database" implementation but in a real-world scenario, all passwords will become invalid once you restart your server.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.