[英]Revoke JWT Oauth2 Refresh Token
I am trying to find a way to revoke Oauth2 JWT Refresh Token with vanilla Spring implementation and JwtTokenStore. 我试图找到一种方法来撤销Oauth2 JWT刷新令牌与vanilla Spring实现和JwtTokenStore。
First: can somebody confirm that there is no API similar to /oauth/token that allows me to revoke a refresh token? 首先:有人可以确认没有类似于/ oauth / token的API允许我撤销刷新令牌吗?
I wanted to add a custom API that would delete the refresh token along the folowing lines: 我想添加一个自定义API,它将沿着以下行删除刷新令牌:
OAuth2RefreshToken oauth2RefreshToken=tokenStore.readRefreshToken(refreshToken);
tokenStore.removeRefreshToken(oauth2RefreshToken);
Now, looking at the JwtTokenStore, I noticed that it uses an ApprovalStore. 现在,看着JwtTokenStore,我注意到它使用了ApprovalStore。 So I went ahead and provided an InMemoryApprovalStore to my JwtTokenStore.
所以我继续向我的JwtTokenStore提供了一个InMemoryApprovalStore。 My JwtTokenStore instantiation this look as follows:
我的JwtTokenStore实例化看起来如下:
@Bean
protected JwtAccessTokenConverter jwtTokenEnhancer() {
JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
converter.setSigningKey("123456");
return converter;
}
@Bean
public JwtTokenStore getTokenStore(){
tokenStore= new JwtTokenStore(jwtTokenEnhancer());
tokenStore.setApprovalStore(new InMemoryApprovalStore());
tokenStore.setTokenEnhancer(jwtTokenEnhancer());
return tokenStore;
};
Results: with no InMemoryApprovalStore, I can authenticate users and refresh tokens without problems. 结果:没有InMemoryApprovalStore,我可以对用户进行身份验证并刷新令牌而不会出现问题。 However, as soon as I add InMemoryApprovalStore to the token store, I start getting the following error message:
但是,只要我将InMemoryApprovalStore添加到令牌存储,我就会收到以下错误消息:
{"error":"invalid_grant","error_description":"Invalid refresh token: eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0NDUwMjQ2MTcsInVzZXJfbmFtZSI6IjYzZjIyYjZlLWU5MGUtNDFjYS1iYzJlLTBmZTgzNmY3MTQ2NyIsImF1dGhvcml0aWVzIjpbIlJPTEVfQURNSU4iLCJST0xFX1VTRVIiXSwianRpIjoiMjgwMDgwNWQtMjk1Zi00ZDQzLWI2NTYtMDNlZWYwMWFkMjg0IiwiY2xpZW50X2lkIjoid2ViLWNsaWVudCIsInNjb3BlIjpbInJlYWQiLCJ3cml0ZSIsInRydXN0Il19.BPC0HqLYjWGM0IFjvsUGGKQ9dyIXSXwMhraCVFIxD0U"}
My second question is thus what is the proper way to revoke a refresh token? 因此,我的第二个问题是撤销刷新令牌的正确方法是什么?
Edit: I found the following thread that suggests that ApprovalStore is indeed the way to revoke JWT tokens. 编辑:我发现以下线程表明ApprovalStore确实是撤销JWT令牌的方法。 I now just need to find out how to use them properly.
我现在只需要找出如何正确使用它们。
First: can somebody confirm that there is no API similar to /oauth/token that allows me to revoke a refresh token?
首先:有人可以确认没有类似于/ oauth / token的API允许我撤销刷新令牌吗?
You don't need to define JwtTokenStore
bean, spring will create it for you using AuthorizationServerEndpointsConfigurer 你不需要定义
JwtTokenStore
bean,spring会使用AuthorizationServerEndpointsConfigurer为你创建它
private TokenStore tokenStore() {
if (tokenStore == null) {
if (accessTokenConverter() instanceof JwtAccessTokenConverter) {
this.tokenStore = new JwtTokenStore((JwtAccessTokenConverter) accessTokenConverter());
}
else {
this.tokenStore = new InMemoryTokenStore();
}
}
return this.tokenStore;
}
private ApprovalStore approvalStore() {
if (approvalStore == null && tokenStore() != null && !isApprovalStoreDisabled()) {
TokenApprovalStore tokenApprovalStore = new TokenApprovalStore();
tokenApprovalStore.setTokenStore(tokenStore());
this.approvalStore = tokenApprovalStore;
}
return this.approvalStore;
}
My second question is thus what is the proper way to revoke a refresh token?
因此,我的第二个问题是撤销刷新令牌的正确方法是什么?
revoke the approval for the token, this was used by JwtTokenStore 撤销对令牌的批准,这是由JwtTokenStore使用的
private void remove(String token) {
if (approvalStore != null) {
OAuth2Authentication auth = readAuthentication(token);
String clientId = auth.getOAuth2Request().getClientId();
Authentication user = auth.getUserAuthentication();
if (user != null) {
Collection<Approval> approvals = new ArrayList<Approval>();
for (String scope : auth.getOAuth2Request().getScope()) {
approvals.add(new Approval(user.getName(), clientId, scope, new Date(), ApprovalStatus.APPROVED));
}
approvalStore.revokeApprovals(approvals);
}
}
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.