Skip to content

Commit 61ca523

Browse files
author
ogorkun
committed
MC-32830: Do not store admin and customer tokens in DB
1 parent ae65242 commit 61ca523

File tree

5 files changed

+105
-102
lines changed

5 files changed

+105
-102
lines changed

‎app/code/Magento/JwtFrameworkAdapter/Model/JweManager.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,11 @@ public function build(JweInterface $jwe, EncryptionSettingsInterface $encryption
114114
} else {
115115
foreach ($jwe->getPerRecipientUnprotectedHeaders() as $i => $header) {
116116
$jwk = $encryptionSettings->getJwkSet()->getKeys()[$i];
117-
$headerData = $this->extractHeaderData($header);
117+
$headerData = [];
118+
if ($jwk->getKeyId()) {
119+
$headerData['kid'] = $jwk->getKeyId();
120+
}
121+
$headerData = array_merge($headerData, $this->extractHeaderData($header));
118122
$headerData['alg'] = $jwk->getAlgorithm();
119123
$builder = $builder->addRecipient(new AdapterJwk($jwk->getJsonData()), $headerData);
120124
}

‎app/code/Magento/JwtFrameworkAdapter/Model/JwsManager.php

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,8 +101,11 @@ public function build(JwsInterface $jws, EncryptionSettingsInterface $encryption
101101
if ($jws->getPayload()->getContentType()) {
102102
$protected['cty'] = $jws->getPayload()->getContentType();
103103
}
104+
if ($jwk->getKeyId()) {
105+
$protected['kid'] = $jwk->getKeyId();
106+
}
104107
if ($jws->getProtectedHeaders()) {
105-
$protected = $this->extractHeaderData($jws->getProtectedHeaders()[$i]);
108+
$protected = array_merge($protected, $this->extractHeaderData($jws->getProtectedHeaders()[$i]));
106109
}
107110
$protected['alg'] = $alg;
108111
$unprotected = [];

‎app/code/Magento/JwtUserToken/Model/ConfigurableJwtSettingsProvider.php

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
use Magento\Authorization\Model\UserContextInterface;
1212
use Magento\Framework\Jwt\EncryptionSettingsInterface;
1313
use Magento\Framework\Jwt\Jwe\JweEncryptionJwks;
14+
use Magento\Framework\Jwt\Jwk;
15+
use Magento\Framework\Jwt\JwkSet;
1416
use Magento\Framework\Jwt\Jws\JwsSignatureJwks;
1517
use Magento\JwtUserToken\Api\ConfigReaderInterface;
1618

@@ -20,12 +22,12 @@
2022
class ConfigurableJwtSettingsProvider implements JwtSettingsProviderInterface
2123
{
2224
/**
23-
* @var EncryptionSettingsInterface[]
25+
* @var EncryptionSettingsInterface[][]
2426
*/
2527
private $jwsEncryptions;
2628

2729
/**
28-
* @var EncryptionSettingsInterface[]
30+
* @var EncryptionSettingsInterface[][]
2931
*/
3032
private $jweEncryptions;
3133

@@ -42,8 +44,8 @@ class ConfigurableJwtSettingsProvider implements JwtSettingsProviderInterface
4244
/**
4345
* @param SecretBasedJwksFactory $secretBasedJwkFactory
4446
* @param ConfigReaderInterface $configReader
45-
* @param EncryptionSettingsInterface[] $jwsEncryptions Additional JWS settings.
46-
* @param EncryptionSettingsInterface[] $jweEncryptions Additional JWE settings.
47+
* @param EncryptionSettingsInterface[][] $jwsEncryptions Additional JWS settings.
48+
* @param EncryptionSettingsInterface[][] $jweEncryptions Additional JWE settings.
4749
*/
4850
public function __construct(
4951
SecretBasedJwksFactory $secretBasedJwkFactory,
@@ -62,7 +64,9 @@ public function __construct(
6264
*/
6365
public function prepareSettingsFor(UserContextInterface $userContext): EncryptionSettingsInterface
6466
{
65-
return $this->prepareAllAccepted()[0];
67+
$settings = $this->prepareAllAccepted();
68+
69+
return array_pop($settings);
6670
}
6771

6872
/**
@@ -76,27 +80,31 @@ public function prepareAllAccepted(): array
7680
if (!array_key_exists($algorithm, $this->jwsEncryptions)) {
7781
//Try to create default settings.
7882
try {
79-
$this->jwsEncryptions[$algorithm] = new JwsSignatureJwks(
83+
$this->jwsEncryptions[$algorithm] = array_map(
84+
function (Jwk $jwk) {
85+
return new JwsSignatureJwks($jwk);
86+
},
8087
$this->secretBasedJwkFactory->createFor($algorithm)
8188
);
8289
} catch (\InvalidArgumentException $exception) {
8390
//Failed to create
84-
$x=1;
8591
}
8692
}
8793
if (!array_key_exists($algorithm, $this->jwsEncryptions)) {
8894
throw new \RuntimeException('JWT settings for algorithm "' .$algorithm .'" not found');
8995
}
9096

91-
return [$this->jwsEncryptions[$algorithm]];
97+
return $this->jwsEncryptions[$algorithm];
9298
} else {
9399
if (!array_key_exists($algorithm, $this->jweEncryptions)) {
94100
//Try to create default settings.
95101
try {
96102
$contentAlg = $this->configReader->getJweContentAlgorithm();
97-
$this->jweEncryptions[$algorithm] = new JweEncryptionJwks(
98-
$this->secretBasedJwkFactory->createFor($algorithm),
99-
$contentAlg
103+
$this->jweEncryptions[$algorithm] = array_map(
104+
function (Jwk $jwk) use ($contentAlg) {
105+
return new JweEncryptionJwks($jwk, $contentAlg);
106+
},
107+
$this->secretBasedJwkFactory->createFor($algorithm)
100108
);
101109
} catch (\InvalidArgumentException $exception) {
102110
//Failed to create
@@ -106,7 +114,7 @@ public function prepareAllAccepted(): array
106114
throw new \RuntimeException('JWT settings for algorithm "' . $algorithm . '" not found');
107115
}
108116

109-
return [$this->jweEncryptions[$algorithm]];
117+
return $this->jweEncryptions[$algorithm];
110118
}
111119
}
112120
}

‎app/code/Magento/JwtUserToken/Model/SecretBasedJwksFactory.php

Lines changed: 67 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -43,116 +43,98 @@ public function __construct(DeploymentConfig $deploymentConfig, JwkFactory $jwkF
4343
}
4444

4545
/**
46-
* Create JWK Set for given algorithm.
46+
* Create JWKs for given algorithm.
4747
*
4848
* @param string $algorithm
49-
* @return JwkSet
49+
* @return Jwk[]
5050
* @throws \InvalidArgumentException When algorithm is not recognized.
5151
*/
52-
public function createFor(string $algorithm): JwkSet
52+
public function createFor(string $algorithm): array
5353
{
5454
switch ($algorithm) {
5555
case Jwk::ALGORITHM_HS256:
56-
return new JwkSet(
57-
array_map(
58-
function (string $key): Jwk {
59-
static $i = 0;
60-
61-
return $this->jwkFactory->createHs256($key, (string) $i++);
62-
},
63-
$this->keys
64-
)
56+
return array_map(
57+
function (string $key): Jwk {
58+
static $i = 0;
59+
60+
return $this->jwkFactory->createHs256($key, (string) ++$i);
61+
},
62+
$this->keys
6563
);
6664
case Jwk::ALGORITHM_HS384:
67-
return new JwkSet(
68-
array_map(
69-
function (string $key): Jwk {
70-
static $i = 0;
71-
72-
return $this->jwkFactory->createHs384($key, (string) $i++);
73-
},
74-
$this->keys
75-
)
65+
return array_map(
66+
function (string $key): Jwk {
67+
static $i = 0;
68+
69+
return $this->jwkFactory->createHs384($key, (string) ++$i);
70+
},
71+
$this->keys
7672
);
7773
case Jwk::ALGORITHM_HS512:
78-
return new JwkSet(
79-
array_map(
80-
function (string $key): Jwk {
81-
static $i = 0;
82-
83-
return $this->jwkFactory->createHs512($key, (string) $i++);
84-
},
85-
$this->keys
86-
)
74+
return array_map(
75+
function (string $key): Jwk {
76+
static $i = 0;
77+
78+
return $this->jwkFactory->createHs512($key, (string) ++$i);
79+
},
80+
$this->keys
8781
);
8882
case Jwk::ALGORITHM_A128KW:
89-
return new JwkSet(
90-
array_map(
91-
function (string $key): Jwk {
92-
static $i = 0;
93-
94-
return $this->jwkFactory->createA128KW($key, (string) $i++);
95-
},
96-
$this->keys
97-
)
83+
return array_map(
84+
function (string $key): Jwk {
85+
static $i = 0;
86+
87+
return $this->jwkFactory->createA128KW($key, (string) ++$i);
88+
},
89+
$this->keys
9890
);
9991
case Jwk::ALGORITHM_A192KW:
100-
return new JwkSet(
101-
array_map(
102-
function (string $key): Jwk {
103-
static $i = 0;
104-
105-
return $this->jwkFactory->createA192KW($key, (string) $i++);
106-
},
107-
$this->keys
108-
)
92+
return array_map(
93+
function (string $key): Jwk {
94+
static $i = 0;
95+
96+
return $this->jwkFactory->createA192KW($key, (string) ++$i);
97+
},
98+
$this->keys
10999
);
110100
case Jwk::ALGORITHM_A256KW:
111-
return new JwkSet(
112-
array_map(
113-
function (string $key): Jwk {
114-
static $i = 0;
115-
116-
return $this->jwkFactory->createA256KW($key, (string) $i++);
117-
},
118-
$this->keys
119-
)
101+
return array_map(
102+
function (string $key): Jwk {
103+
static $i = 0;
104+
105+
return $this->jwkFactory->createA256KW($key, (string) ++$i);
106+
},
107+
$this->keys
120108
);
121109
case Jwk::ALGORITHM_A128GCMKW:
122-
return new JwkSet(
123-
array_map(
124-
function (string $key): Jwk {
125-
static $i = 0;
126-
127-
return $this->jwkFactory->createA128Gcmkw($key, (string) $i++);
128-
},
129-
$this->keys
130-
)
110+
return array_map(
111+
function (string $key): Jwk {
112+
static $i = 0;
113+
114+
return $this->jwkFactory->createA128Gcmkw($key, (string) ++$i);
115+
},
116+
$this->keys
131117
);
132118
case Jwk::ALGORITHM_A192GCMKW:
133-
return new JwkSet(
134-
array_map(
135-
function (string $key): Jwk {
136-
static $i = 0;
137-
138-
return $this->jwkFactory->createA192Gcmkw($key, (string) $i++);
139-
},
140-
$this->keys
141-
)
119+
return array_map(
120+
function (string $key): Jwk {
121+
static $i = 0;
122+
123+
return $this->jwkFactory->createA192Gcmkw($key, (string) ++$i);
124+
},
125+
$this->keys
142126
);
143127
case Jwk::ALGORITHM_A256GCMKW:
144-
return new JwkSet(
145-
array_map(
146-
function (string $key): Jwk {
147-
static $i = 0;
148-
149-
return $this->jwkFactory->createA256Gcmkw($key, (string) $i++);
150-
},
151-
$this->keys
152-
)
128+
return array_map(
129+
function (string $key): Jwk {
130+
static $i = 0;
131+
132+
return $this->jwkFactory->createA256Gcmkw($key, (string) ++$i);
133+
},
134+
$this->keys
153135
);
154136
default:
155-
throw new \InvalidArgumentException('Unknown algorithm "' .$algorithm .'"');
137+
throw new \InvalidArgumentException('Unknown algorithm "' . $algorithm . '"');
156138
}
157139
}
158140
}

‎dev/tests/integration/testsuite/Magento/Framework/Jwt/JwtManagerTest.php

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,12 @@ public function testCreateRead(
7676
) {
7777
$this->verifyAgainstHeaders([$jwt->getHeader()], $recreated->getHeader());
7878
}
79+
if ($readEncryption instanceof JwsSignatureJwks) {
80+
if ($kid = $readEncryption->getJwkSet()->getKeys()[0]->getKeyId()) {
81+
$this->assertNotNull($jwt->getHeader()->getParameter('kid'));
82+
$this->assertEquals($kid, $jwt->getHeader()->getParameter('kid'));
83+
}
84+
}
7985
//Verifying payload
8086
$this->assertEquals($jwt->getPayload()->getContent(), $recreated->getPayload()->getContent());
8187
if ($jwt->getPayload() instanceof ClaimsPayloadInterface) {
@@ -319,8 +325,8 @@ public function getTokenVariants(): array
319325
),
320326
null,
321327
[
322-
new JweHeader([new PrivateHeaderParameter('tst', 2), new KeyId('1')]),
323-
new JweHeader([new PrivateHeaderParameter('test2', 3), new KeyId('2')])
328+
new JweHeader([new PrivateHeaderParameter('tst', 2), new KeyId('2')]),
329+
new JweHeader([new PrivateHeaderParameter('test2', 3), new KeyId('1')])
324330
],
325331
new ClaimsPayload(
326332
[
@@ -366,7 +372,7 @@ public function getTokenVariants(): array
366372
],
367373
'jws-HS384' => [
368374
$flatJws,
369-
$enc = new JwsSignatureJwks($jwkFactory->createHs384($sharedSecret)),
375+
$enc = new JwsSignatureJwks($jwkFactory->createHs384($sharedSecret, '3')),
370376
[$enc]
371377
],
372378
'jws-HS512' => [

0 commit comments

Comments
 (0)