∷ Text → AuthHandler Wai.Request (JWT VerifiedJWT)
authHandler secKey = mkAuthHandler h
  where h req = Servant.Server.Handler $
          case asum [ fromHeader =<< lookup hAuthorization (Wai.requestHeaders req)
                    , join $ lookup "access_token" $ Wai.queryString req
                    , lookup "Bearer" =<< parseCookies <$> lookup hCookie (Wai.requestHeaders req)
                    ] of
            Nothing → throwM errNoAuth
            Just tok →
              case decodeAndVerifySignature (hmacSecret secKey) (cs tok) of
                Nothing → throwM errWrongAuth
                Just decodedToken → do
                  -- !!! Only allow tokens issued by the current Host !!!
                  if (fromMaybe "" $ lookup "Host" $ Wai.requestHeaders req) == (cs $ show $ fromJust $ iss $ claims decodedToken)
                  then return decodedToken
                  else throwM errWrongAuth

fromHeader ∷ ByteStrin
authHandler ∷ Text → AuthHandler Wai.Request (JWT VerifiedJWT)
authHandler secKey = mkAuthHandler h
  where h req = Servant.Server.Handler $
          case asum [ fromHeader =<< lookup hAuthorization (Wai.requestHeaders req)
                    , join $ lookup "access_token" $ Wai.queryString req
                    , lookup "Bearer" =<< parseCookies <$> lookup hCookie (Wai.requestHeaders req)
                    ] of
            Nothing → throwM errNoAuth
            Just tok →
              case decodeAndVerifySignature (hmacSecret secKey) (cs tok) of
                Nothing → throwM errWrongAuth
                Just decodedToken → do
                  -- !!! Only allow tokens issued by the current Host !!!
                  if (fromMaybe "" $ lookup "Host" $ Wai.requestHeaders req) == (cs $ show $ fromJust $ iss $ claims decodedToken)
                  then return decodedToken
                  else throwM errWrongAuth
authHandler secKey = mkAuthHandler h
  where h req = Servant.Server.Handler $
          case asum [ fromHeader =<< lookup hAuthorization (Wai.requestHeaders req)
                    , join $ lookup "access_token" $ Wai.queryString req
                    , lookup "Bearer" =<< parseCookies <$> lookup hCookie (Wai.requestHeaders req)
                    ] of
            Nothing → throwM errNoAuth
            Just tok →
              case decodeAndVerifySignature (hmacSecret secKey) (cs tok) of
                Nothing → throwM errWrongAuth
                Just decodedToken → do
                  -- !!! Only allow tokens issued by the current Host !!!
                  if (fromMaybe "" $ lookup "Host" $ Wai.requestHeaders req) == (cs $ show $ fromJust $ iss $ claims decodedToken)
                  then return decodedToken
                  else throwM errWrongAuth