Protect your Function with JSON Web Token

1
const jwt = require('jsonwebtoken');
2

3
// Hardcoded credentials for this example
4
const creds = {
5
  username: 'twilio',
6
  password: 'ahoy',
7
};
8
// Hardcoded secret for this example. In a real app, you would
9
// generate this and store it securely as an environment variable
10
// and access it via context.SECRET or similar
11
const secret = 'secret_key';
12

13
// Function to generate a JWT token
14
exports.handler = (context, event, callback) => {
15
  // Retrieve the username and password from the request
16
  const { username, password } = event;
17
  // Prepare a new Twilio response
18
  const response = new Twilio.Response();
19

20
  // If the provided credentials are invalid, return 401 Unauthorized.
21
  // In a real app you would check the credentials against your database.
22
  if (username !== creds.username || password !== creds.password) {
23
    response
24
      .setBody('Username or password is incorrect')
25
      .setStatusCode(401);
26

27
    return callback(null, response);
28
  }
29

30
  // Create a new signed JWT for the user that will expire in 1 day.
31
  // To understand more about JWT and what sub, iss, and these
32
  // other options are, see https://jwt.io/
33
  const token = jwt.sign(
34
    {
35
      sub: username,
36
      iss: 'twil.io',
37
      org: 'twilio',
38
      perms: ['read'],
39
    },
40
    secret,
41
    { expiresIn: '1d' }
42
  );
43

44
  // Set the token as the access_token header and return the response
45
  response.setBody('OK').appendHeader('access_token', token);
46

47
  return callback(null, response);
48
};

1
const jwt = require('jsonwebtoken');
2

3
const employeeSalaries = [
4
  {
5
    username: 'jdoe',
6
    salary: '$2000.00',
7
  },
8
  {
9
    username: 'mturner',
10
    salary: '$2500.00',
11
  },
12
];
13
const secret = 'secret_key'; // keep this in env variables
14

15
// Function that exposes sensitive information and requires
16
// a valid JWT token to be present in the request header to access.
17
exports.handler = (context, event, callback) => {
18
  // Grab the auth token from the request header
19
  const authHeader = event.request.headers.authorization;
20
  // Prepare a new Twilio response
21
  const response = new Twilio.Response();
22
  // Reject requests that don't have an Authorization header
23
  if (!authHeader) return callback(null, setUnauthorized(response));
24

25
  // The auth type and token are separated by a space, split them
26
  const [authType, authToken] = authHeader.split(' ');
27
  // If the auth type is not Bearer, return a 401 Unauthorized response
28
  if (authType.toLowerCase() !== 'bearer')
29
    return callback(null, setUnauthorized(response));
30

31
  try {
32
    // Verify the token against the secret. If the token is invalid,
33
    // jwt.verify will throw an error and we'll proceed to the catch block
34
    jwt.verify(authToken, secret);
35
    // At this point, the request has been validated and you could do
36
    // whatever you want with the request.
37
    // For this example, we'll just return the employee salaries
38
    return callback(null, employeeSalaries);
39
  } catch (e) {
40
    // If an error was thrown, the token is invalid and we should
41
    // return a 401 Unauthorized response
42
    return callback(null, setUnauthorized(response));
43
  }
44
};
45

46
// Helper method to format the response as a 401 Unauthorized response
47
// with the appropriate headers and values
48
const setUnauthorized = (response) => {
49
  response
50
    .setBody('Unauthorized')
51
    .setStatusCode(401)
52
    .appendHeader(
53
      'WWW-Authenticate',
54
      'Bearer realm="Access to read salaries"'
55
    );
56

57
  return response;
58
};

1
$ curl -i -L -X POST 'https://auth-4173-dev.twil.io/bearer' -i
2

3
HTTP/2 401
4
date: Tue, 03 Aug 2021 23:01:55 GMT
5
content-type: application/octet-stream
6
content-length: 12
7
www-authenticate: Bearer realm="Access to read salaries"
8
x-shenanigans: none
9

10
Unauthorized

1
curl -i -L -X POST 'https://auth-4173-dev.twil.io/jwt' \
2
-H 'Content-Type: application/json' \
3
--data-raw '{
4
    "username": "twilio",
5
    "password": "ahoy"
6
}'

1
$ curl -i -L -X POST 'https://auth-4173-dev.twil.io/jwt' \
2
-H 'Content-Type: application/json' \
3
--data-raw '{
4
    "username": "twilio",
5
    "password": "ahoy"
6
}'
7

8
HTTP/2 200
9
date: Tue, 03 Aug 2021 23:16:35 GMT
10
content-type: application/octet-stream
11
content-length: 2
12
access_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0d2lsaW8iLCJpc3MiOiJ0d2lsLmlvIiwib3JnIjoidHdpbGlvIiwicGVybXMiOlsicmVhZCJdLCJpYXQiOjE2MjgwMzI1OTUsImV4cCI6MTYyODExODk5NX0.uZzHuN5PpK6qM5wCu01_S8lkFPDpIcxQJq6A7sDr6gc
13
x-shenanigans: none
14
x-content-type-options: nosniff
15
x-xss-protection: 1; mode=block
16

17
OK

1
curl -i -L -X POST 'https://auth-4173-dev.twil.io/bearer' \
2
-H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0d2lsaW8iLCJpc3MiOiJ0d2lsLmlvIiwib3JnIjoidHdpbGlvIiwicGVybXMiOlsicmVhZCJdLCJpYXQiOjE2MjgwMzA3ODIsImV4cCI6MTYyODExNzE4Mn0.gBusSFmlRt_o3H3E2UB4GGxjbZJLOOS0bKFXTxAgnlw'

1
$ curl -i -L -X POST 'https://auth-4173-dev.twil.io/bearer' \
2
-H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0d2lsaW8iLCJpc3MiOiJ0d2lsLmlvIiwib3JnIjoidHdpbGlvIiwicGVybXMiOlsicmVhZCJdLCJpYXQiOjE2MjgwMzA3ODIsImV4cCI6MTYyODExNzE4Mn0.gBusSFmlRt_o3H3E2UB4GGxjbZJLOOS0bKFXTxAgnlw'
3

4
HTTP/2 200
5
date: Tue, 03 Aug 2021 23:20:10 GMT
6
content-type: application/json
7
content-length: 84
8
x-shenanigans: none
9
x-content-type-options: nosniff
10
x-xss-protection: 1; mode=block
11

12
[{"username":"jdoe","salary":"$2000.00"},{"username":"mturner","salary":"$2500.00"}]