Jwt exceptions invalid audience error invalid audience

Python JWT Certification Method Introduction

JWT introduction

JWT (JSON Web Tokens) is a development of industry standard RFC 7519 for security representation between the parties. At present, JWT is widely used in the system’s user authentication, especially now the front-rear end separation project.

JWT certification process:

In project development, it is generally certified in accordance with the procedures shown above, ie after the user logs in, the server returns a token to the user browser, and the user browser should bring token to send requests, the server Check the legality of Token, legal, give the user to watch data, otherwise, return some error messages

What is the difference between traditional TOKEN mode and JWT in certification?

• Traditional token method: After the user is logged in, the server generates a random token to the user, and saves one token in the server (database or cache). After the user is accessible, it is necessary to carry token, after receiving token, go to the database or cache Whether the check token is timeout, is it legal?
• JWT wayAfter the user login successfully, the server generates a random token to the user (the server does not need to keep token) with JWT. After the user is accessible, the server will be taken to TOKEN. After the server is used, the check is timeout, is it legal

2. JWT Create token

2.1 JWT generation principle

JWT generation token format is as follows, namely: 3-segment string connected to the connection

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

The generation rules are as follows:

• First paragraphHEADER Part, fixedly inclusive algorithm and token type, this JSON is Base64URL encryption, this is the first paragraph of Token

{
"alg": "HS256",
"typ": "JWT"
}

• Second paragraphPAYLOAD Part, contain some data, Base64URL encryption for this JSON, this is the second paragraph of Token

{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
...
}

• Third paragraphSIGNATURE Part, put the top two Base64url ciphertext. Splicing, then HS256 encryption, then subsequently encrypt the HS256 ciphertext, and finally get token’s third paragraph

base64url(
	HMACSHA256(
		base64UrlEncode(header) + "." + base64UrlEncode(payload),
	 Your-256-bit-secret (Key salt)
	)
)

Finally, three strings are passed. Stitching and generates JWT token

2.2 JWT verification token principle

Usually after the authentication is successful, return the JWT generated token to the user, and the user needs to carry token when the user is once again, and the jwt needs timeout and legality checking to TOKEN.

After getting Token, you will check the following steps:

• Separate token intoheader_segment 、payload_segment 、crypto_segment three parts

JWT_TOKEN =
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"

signing_input, crypto_segment = JWT_TOKEN.rsplit('.', 1)
header_segment, payload_segment = signing_input.split('.', 1)

• Base64URL decryption for the first part of Header_SEGMENT, getheader
• Base64URL decryption for the second part of PAYLOAD_SEGMENT, getpayload
• Base64URL decryption for the third part CRYPTO_SEGMENT, getsignature, Targetingsignature Part of the data for legitimacy verification
  • Two paragraphs before stitching, namely:signing_input
  • Obtain an encryption algorithm from the first paragraph, default:HS256
  • Use algorithm + salt pairsigning_input Encryption, the results will be obtained andsignature Cipher comparison

3. Code implementation

Python-based Pyjwt module creates JWT token

• Install

pip3 install pyjwt

• accomplish

from datetime import datetime, timedelta

import jwt


class JwtToken(object):

    _salt = "@^4_00wedv**pi)+(!w1rwi=d3q4l=ie=g-u$s8jevmj*zgg2h" 

    _expire_message = DICT (code = 1200, msg = "token has been invalid")

         _unknown_error_message = dict (code = 4200, msg = "token resolution failed")

    @classmethod
    def generate_token(cls, payload: dict) -> str:
        headers = dict(typ="jwt", alg="HS256")
        resut = jwt.encode(payload=payload, key=cls._salt, algorithm="HS256", headers=headers)
        return resut

    @classmethod
    def parse_token(cls, token: str) -> tuple:
        verify_status = False
        try:
            payload_data = jwt.decode(token, cls._salt, algorithms=['HS256'])
            verify_status = True
        except jwt.ExpiredSignatureError:
            payload_data = cls._expire_message
        except Exception as _err:
            payload_data = cls._unknown_error_message
        return verify_status, payload_data


if __name__ == '__main__':
    TEST_DATA = dict(name="mooor", exp=datetime.utcnow() - timedelta(seconds=1))
    token = JwtToken.generate_token(TEST_DATA)
    print(token)
    payload = JwtToken.parse_token(token)
    print(payload)

Notice: EXP must chooseUTC time

Expiration time will be compared to the current UTC time (as given by timegm(datetime.utcnow().utctimetuple())), so be sure to use a UTC timestamp or datetime in encoding

4. Parameter introduction

4.1 Example:

import jwt
import datetime

dic = {
         'Exp': DateTime.Datetime.utcnow () + DateTime.timedelta (Days = 1), # 过 time
         'IAT': datetime.datetime.utcnow (), # start time
         'ISS': 'Chaosmoor', # Signature
         'data': {# content, usually store the user ID and start time
        'a': 1,
        'b': 2,
    },
}


 Token = jwt.encode (DIC, 'Secret', Algorithm = 'HS256') # Encryption Generate Strings
print(token)

 PayLoad = jwt.decode (token, 'secret', Issuer = 'lianzong', algorithms = ['HS256']) # Decryption, check signature
print(s)
print(type(s))

DIC has official designated key, and the program will determine whether it is legal according to the value of the value of the key when decrypt. These keys are:

• exp: When generating token, you can set the effective time of the Token, if we set up 1 day, we will resolve this token will thrown 1 day after 1 day.

jwt.exceptions.ExpiredSignatureError: Signature has expired

• nbf: It refers to the effective time of the Token, if it is used, but there is no effective time:

jwt.exceptions.ImmatureSignatureError: The token is not yet valid (nbf)

• iss: TOKEN’s issuer, we can give him a string, note that if the ISS is not checked if it is not checked, if we need to test it, it will be thrown, it will thrown

jwt.exceptions.InvalidIssuerError: Invalid issuer

• aud: Specify the recipient, the recipient must provide the consistent recipient (string) required by the TOKEN when receiving, if the receiver or the recipient will be thrown out

jwt.exceptions.InvalidAudienceError: Invalid audience

• iat: Token’s start time, if the current time throws before starting time

jwt.exceptions.InvalidIssuedAtError: Issued At claim (iat) cannot be in the future.

4.2 Pyjwt official documentation

https://pyjwt.readthedocs.io/en/latest/usage.html