@Test public void shouldFailToAuthenticateUsingSecretIfTokenHasExpired() throws Exception { Calendar calendar = Calendar.getInstance(); calendar.add(Calendar.SECOND, -10); Date tenSecondsAgo = calendar.getTime(); JwtAuthenticationProvider provider = new JwtAuthenticationProvider("secret".getBytes(), "test-issuer", "test-audience"); String token = JWT.create() .withAudience("test-audience") .withIssuer("test-issuer") .withExpiresAt(tenSecondsAgo) .sign(Algorithm.HMAC256("secret")); Authentication authentication = PreAuthenticatedAuthenticationJsonWebToken.usingToken(token); exception.expect(BadCredentialsException.class); exception.expectMessage("Not a valid token"); exception.expectCause(Matchers.<Throwable>instanceOf(TokenExpiredException.class)); provider.authenticate(authentication); }
@Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (!supports(authentication.getClass())) { return null; } JwtAuthentication jwt = (JwtAuthentication) authentication; try { final Authentication jwtAuth = jwt.verify(jwtVerifier(jwt)); logger.info("Authenticated with jwt with scopes {}", jwtAuth.getAuthorities()); return jwtAuth; } catch (JWTVerificationException e) { throw new BadCredentialsException("Not a valid token", e); } }
JwtAuthenticationProvider implements AuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (!supports(authentication.getClass())) { return null; } JwtAuthentication jwt = (JwtAuthentication) authentication; try { final Authentication jwtAuth = jwt.verify(jwtVerifier(jwt)); logger.info("Authenticated with jwt with scopes {}", jwtAuth.getAuthorities()); return jwtAuth; } catch (JWTVerificationException e) { throw new BadCredentialsException("Not a valid token", e); } } }
JwtAuthenticationProvider implements AuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (!supports(authentication.getClass())) { return null; } JwtAuthentication jwt = (JwtAuthentication) authentication; try { final Authentication jwtAuth = jwt.verify(jwtVerifier(jwt)); logger.info("Authenticated with jwt with scopes {}", jwtAuth.getAuthorities()); return jwtAuth; } catch (JWTVerificationException e) { throw new BadCredentialsException("Not a valid token", e); } } JwtAuthenticationProvider(byte[] secret, String issuer, String audience);  JwtAuthenticationProvider(JwkProvider jwkProvider, String issuer, String audience);  JwtAuthenticationProvider(byte[] secret, String[] issuers, String audience);  JwtAuthenticationProvider(JwkProvider jwkProvider,  String[] issuers, String audience); }
JwtAuthenticationProvider implements AuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (!supports(authentication.getClass())) { return null; } JwtAuthentication jwt = (JwtAuthentication) authentication; try { final Authentication jwtAuth = jwt.verify(jwtVerifier(jwt)); logger.info("Authenticated with jwt with scopes {}", jwtAuth.getAuthorities()); return jwtAuth; } catch (JWTVerificationException e) { throw new BadCredentialsException("Not a valid token", e); } } JwtAuthenticationProvider(byte[] secret, String issuer, String audience);  JwtAuthenticationProvider(JwkProvider jwkProvider, String issuer, String audience);  JwtAuthenticationProvider(byte[] secret, String[] issuers, String audience);  JwtAuthenticationProvider(JwkProvider jwkProvider,  String[] issuers, String audience); @Override boolean supports(Class<?> authentication); @Override Authentication authenticate(Authentication authentication); @SuppressWarnings("unused") JwtAuthenticationProvider withJwtVerifierLeeway(long leeway); }
JwtAuthenticationProvider implements AuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (!supports(authentication.getClass())) { return null; } JwtAuthentication jwt = (JwtAuthentication) authentication; try { final Authentication jwtAuth = jwt.verify(jwtVerifier(jwt)); logger.info("Authenticated with jwt with scopes {}", jwtAuth.getAuthorities()); return jwtAuth; } catch (JWTVerificationException e) { throw new BadCredentialsException("Not a valid token", e); } } JwtAuthenticationProvider(byte[] secret, String issuer, String audience);  JwtAuthenticationProvider(JwkProvider jwkProvider, String issuer, String audience);  JwtAuthenticationProvider(byte[] secret, String[] issuers, String audience);  JwtAuthenticationProvider(JwkProvider jwkProvider,  String[] issuers, String audience); @Override boolean supports(Class<?> authentication); @Override Authentication authenticate(Authentication authentication); @SuppressWarnings("unused") JwtAuthenticationProvider withJwtVerifierLeeway(long leeway);  }