Feature/implement backend authentication #68
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| package authenticator | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "os" | ||
|
|
||
| "github.com/coreos/go-oidc/v3/oidc" | ||
| "golang.org/x/oauth2" | ||
| ) | ||
|
|
||
| // Authenticator is used to authenticate our users. | ||
| type Authenticator struct { | ||
| *oidc.Provider | ||
| oauth2.Config | ||
| } | ||
|
|
||
| func New() (*Authenticator, error) { | ||
| provider, err := oidc.NewProvider( | ||
| context.Background(), | ||
| "https://"+os.Getenv("AUTH0_DOMAIN")+"/", | ||
| ) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| conf := oauth2.Config{ | ||
| ClientID: os.Getenv("AUTH0_CLIENT_ID"), | ||
| ClientSecret: os.Getenv("AUTH0_CLIENT_SECRET"), | ||
| Endpoint: provider.Endpoint(), | ||
| Scopes: []string{oidc.ScopeOpenID, "profile"}, | ||
| } | ||
|
|
||
| return &Authenticator{ | ||
| Provider: provider, | ||
| Config: conf, | ||
| }, nil | ||
| } | ||
|
|
||
| func (a *Authenticator) VerifyIDToken(ctx context.Context, token *oauth2.Token) (*oidc.IDToken, error) { | ||
| rawIDToken, ok := token.Extra("id_token").(string) | ||
|
There was a problem hiding this comment. what is this There was a problem hiding this comment. Also, I just read up more on the different token types for JWT. There is an ID token and Access token type. ID tokens should be used for authentication (i.e. a user is a valid user) and access tokens should be used for authorisation (i.e. a user is valid and is authorised to perform a certain action).
So you'll need to consider which APIs require an ID token, and which ones require an Access token and use the correct middleware accordingly. In our scenario, I believe we should be using Access tokens instead. There was a problem hiding this comment. The quick start guide I was using is post login when I created the application. The guide only showed how to integrate authentication and not authorisation, hence the discrepancy here I think. Ill just refer to the guide you mentioned. |
||
| if !ok { | ||
| return nil, errors.New("no id_token field in oauth2 token") | ||
| } | ||
|
|
||
| oidcConfig := &oidc.Config{ | ||
| ClientID: a.ClientID, | ||
| } | ||
|
|
||
| return a.Verifier(oidcConfig).Verify(ctx, rawIDToken) | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -35,6 +35,7 @@ func addRoutes(r *mux.Router) { | |
| func New() http.Handler { | ||
| router := mux.NewRouter() | ||
| addRoutes(router) | ||
| router.Use(IsAuthenticated) | ||
|
There was a problem hiding this comment. We have 2 options:
Method 1 reduces the amount of code to write but it assumes that every handler requires authentication. It might just be better to opt for method 2, even though we have to repeat ourselves every time. Thoughts? reference: https://auth0.com/blog/id-token-access-token-what-is-the-difference/ There was a problem hiding this comment. Thing is I can't think of a situation where authentication is not required. The only possibility would be a server side landing page, but since our backend is purely just API, there should not be any paths where authorisation middleware is not required. In that case, since the only differentiation is between authorisation for different roles, I think we just do two bah |
||
| handlers.CORS( | ||
| handlers.AllowedOrigins([]string{"http://localhost:3000"}), | ||
| handlers.AllowedHeaders([]string{ | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
should we be setting the scope here? I'm not too familiar
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This was based off their quick start guide so we just stick with this first until changes are required bah since it doesn't seem to create any immediate issues in my mind