Protect your Function with JSON Web Token

When protecting your public Functions and any sensitive data that they can expose, from unwanted requests and bad actors, it is important to consider some form of authentication to validate that only intended users are making requests. In this example, we'll be covering one of the most common forms of authentication: Bearer Authentication using JSON Web Token (JWT).

If you want to learn an alternative approach, you can also see this example of using Basic Auth.

Let's create a Function that will only accept requests with valid JWTs, and reject all other traffic.

Configure your Function to require Bearer Authentication

First, create a new auth Service and add two Public Functions using the directions above. These will be named:

• /jwt
• /bearer

Replace the default contents of each Function with the JWT generation code (Generate a JSON Web Token for Function Authentication) for /jwt, and the JWT validation snippet (Authenticate Function requests using Bearer Authorization and JWT) for /bearer respectively. Save both Functions once they contain the new code.

Next, notice that the code snippets require the jsonwebtoken dependency. Be sure to add this as a Dependency to your Service.

Once all Functions have been saved and your Dependencies have been set, deploy the Function by clicking on Deploy All in the Console UI.

Verify that Bearer Authentication is working

We can check that authentication is working first by sending an unauthenticated request to our deployed Function. You can get the URL of your Function by clicking the Copy URL button next to the Function.

Then, using your client of choice, make a GET or POST request to your Function. It should return a 401 Unauthorized since the request contains no valid Authorization header.

curl -i -L -X POST 'https://auth-4173-dev.twil.io/bearer'

Result:

$ curl -i -L -X POST 'https://auth-4173-dev.twil.io/bearer' -i

HTTP/2 401
date: Tue, 03 Aug 2021 23:01:55 GMT
content-type: application/octet-stream
content-length: 12
www-authenticate: Bearer realm="Access to read salaries"
x-shenanigans: none

Unauthorized

Great! Requests are successfully being blocked from non-authenticated requests.

To make an authenticated request and get back a 200 OK, we'll need to first generate a valid JWT by calling /jwt. We can then include that token in the Authorization header of our request to /bearer.

To get a valid JWT, we'll need to submit a valid username and password to the /jwt Function. Right now, these are hardcoded in the Function as twilio and ahoy respectively. The JWT generator Function is expecting the username and password to be passed in the body of the request, so you'll need to create a POST request with a JSON body composed of those values. Using cURL, that would look like this:

curl -i -L -X POST 'https://auth-4173-dev.twil.io/jwt' \
-H 'Content-Type: application/json' \
--data-raw '{
    "username": "twilio",
    "password": "ahoy"
}'

and the response would be:

$ curl -i -L -X POST 'https://auth-4173-dev.twil.io/jwt' \
-H 'Content-Type: application/json' \
--data-raw '{
    "username": "twilio",
    "password": "ahoy"
}'

HTTP/2 200
date: Tue, 03 Aug 2021 23:16:35 GMT
content-type: application/octet-stream
content-length: 2
access_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0d2lsaW8iLCJpc3MiOiJ0d2lsLmlvIiwib3JnIjoidHdpbGlvIiwicGVybXMiOlsicmVhZCJdLCJpYXQiOjE2MjgwMzI1OTUsImV4cCI6MTYyODExODk5NX0.uZzHuN5PpK6qM5wCu01_S8lkFPDpIcxQJq6A7sDr6gc
x-shenanigans: none
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

OK

The header access_token contains the valid JWT that was just generated for us. Go ahead and try your request to /bearer again, but this time including the Authorization header including this JWT:

curl -i -L -X POST 'https://auth-4173-dev.twil.io/bearer' \
-H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0d2lsaW8iLCJpc3MiOiJ0d2lsLmlvIiwib3JnIjoidHdpbGlvIiwicGVybXMiOlsicmVhZCJdLCJpYXQiOjE2MjgwMzA3ODIsImV4cCI6MTYyODExNzE4Mn0.gBusSFmlRt_o3H3E2UB4GGxjbZJLOOS0bKFXTxAgnlw'

the response should be:

$ curl -i -L -X POST 'https://auth-4173-dev.twil.io/bearer' \
-H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0d2lsaW8iLCJpc3MiOiJ0d2lsLmlvIiwib3JnIjoidHdpbGlvIiwicGVybXMiOlsicmVhZCJdLCJpYXQiOjE2MjgwMzA3ODIsImV4cCI6MTYyODExNzE4Mn0.gBusSFmlRt_o3H3E2UB4GGxjbZJLOOS0bKFXTxAgnlw'

HTTP/2 200
date: Tue, 03 Aug 2021 23:20:10 GMT
content-type: application/json
content-length: 84
x-shenanigans: none
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

[{"username":"jdoe","salary":"$2000.00"},{"username":"mturner","salary":"$2500.00"}]

At this point, Bearer Authentication is working for your Function!

To make this example your own, you could experiment with the following:

• Refactor the common 'secret_key' into an Environment Variable so that it is stored securely and only needs to be changed in one place.
• Use Environment Variables to store the approved credentials, or even create a database of approved usernames and passwords to support multiple users.
• Instead of using a hardcoded array of data, retrieve values from a database.