Merge pull request vert-x#22 from vert-x3/feature/example-jwt

jwt example
vietj · Jun 5, 2015 · 60081ad · 60081ad
2 parents 0ebe697 + 860c8ef
commit 60081ad
Show file tree

Hide file tree

Showing 5 changed files with 129 additions and 19 deletions.
diff --git a/web-examples/README.adoc b/web-examples/README.adoc
@@ -155,27 +155,18 @@ was successful.
 Run the server either in your IDE or on the command line, then open your browser and hit
 link:http://localhost:8080 and click around the links
 
+== JWT example
 
+This example shows a basic single page application that contains an API that is protected by a JWT.
 
+The link:src/main/java/io/vertx/example/web/jwt/[Java jwt example]
 
+Requests to paths starting with `/api/` will require a JWT token, except the excluded `/api/newToken`. This exclusion is
+normaly used as the login end point, however in this example we are not focusing on secure login end points and we just
+return a new token for any request.
 
+The application contains a simple form where you can request some data from the API if there is no token loaded then the
+response is an `HTTP error 401`. When a token is loaded, then a successful response if received from the API.
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+Run the server either in your IDE or on the command line, then open your browser and hit
+link:http://localhost:8080 and click around the links
diff --git a/web-examples/pom.xml b/web-examples/pom.xml
@@ -38,6 +38,12 @@
  <version>${project.version}</version>
  </dependency>
 
+ <dependency>
+ <groupId>io.vertx</groupId>
+ <artifactId>vertx-auth-jwt</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+
  <dependency>
  <groupId>io.vertx</groupId>
  <artifactId>examples-utils</artifactId>

diff --git a/web-examples/src/main/java/io/vertx/example/web/jwt/Server.java b/web-examples/src/main/java/io/vertx/example/web/jwt/Server.java
@@ -0,0 +1,58 @@
+package io.vertx.example.web.jwt;
+
+import io.vertx.core.AbstractVerticle;
+import io.vertx.core.http.HttpHeaders;
+import io.vertx.core.json.JsonObject;
+import io.vertx.example.util.Runner;
+import io.vertx.ext.auth.AuthProvider;
+import io.vertx.ext.auth.jwt.JWTAuth;
+import io.vertx.ext.auth.jwt.JWTOptions;
+import io.vertx.ext.auth.shiro.ShiroAuth;
+import io.vertx.ext.auth.shiro.ShiroAuthRealmType;
+import io.vertx.ext.web.Router;
+import io.vertx.ext.web.handler.*;
+import io.vertx.ext.web.sstore.LocalSessionStore;
+
+/*
+ * @author <a href="mailto:pmlopes@gmail.com">Paulo Lopes</a>
+ */
+public class Server extends AbstractVerticle {
+
+ // Convenience method so you can run it in your IDE
+ public static void main(String[] args) {
+ Runner.runExample(Server.class);
+ }
+
+ @Override
+ public void start() throws Exception {
+
+ Router router = Router.router(vertx);
+
+ // Create a JWT Auth Provider
+ JWTAuth jwt = JWTAuth.create(new JsonObject()
+ .put("keyStoreType", "jceks")
+ .put("keyStoreURI", "classpath:///keystore.jceks")
+ .put("keyStorePassword", "secret"));
+
+ // protect the API
+ router.route("/api/*").handler(JWTAuthHandler.create(jwt, "/api/newToken"));
+
+ // this route is excluded from the auth handler
+ router.get("/api/newToken").handler(ctx -> {
+ ctx.response().putHeader(HttpHeaders.CONTENT_TYPE, "text/plain");
+ ctx.response().end(jwt.generateToken(new JsonObject(), new JWTOptions().setExpiresInSeconds(60)));
+ });
+
+ // this is the secret API
+ router.get("/api/protected").handler(ctx -> {
+ ctx.response().putHeader(HttpHeaders.CONTENT_TYPE, "text/plain");
+ ctx.response().end("a secret you should keep for yourself...");
+ });
+
+ // Serve the non private static pages
+ router.route().handler(StaticHandler.create());
+
+ vertx.createHttpServer().requestHandler(router::accept).listen(8080);
+ }
+}
+
diff --git a/web-examples/src/main/java/io/vertx/example/web/jwt/webroot/index.html b/web-examples/src/main/java/io/vertx/example/web/jwt/webroot/index.html
@@ -0,0 +1,55 @@
+<html>
+<head>
+ <script src="http://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
+</head>
+<body>
+
+<h1>Web site with public and private pages</h1>
+
+<br>
+<br>
+
+<div id="login">
+ <a href="#" id="generateToken">Get a Token</a>
+ <div id="token">Current token:</div>
+</div>
+
+<br>
+<br>
+
+<div id="test">
+ <a href="#" id="getProtected">Get Protected Resource</a>
+ <div id="protected"></div>
+</div>
+
+<script language="JavaScript">
+ $(document).ready(function () {
+ $('#generateToken').on('click', function () {
+ $.ajax({
+ url: '/api/newToken',
+ dataType: 'text',
+ success: function (text) {
+ $('#token').html('Current Token: ' + text);
+ }
+ });
+ });
+
+ $('#getProtected').on('click', function () {
+ $.ajax({
+ url: '/api/protected',
+ dataType: 'text',
+ headers: {
+ "Authorization": "Bearer " + $('#token').html().substring(15)
+ },
+ success: function (text) {
+ $('#protected').html(text);
+ },
+ error: function (err) {
+ $('#protected').html('Error: ' + err.toString());
+ }
+ });
+ });
+ });
+</script>
+</body>
+</html>
diff --git a/web-examples/src/main/resources/keystore.jceks b/web-examples/src/main/resources/keystore.jceks