JWTService.cs

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Web;
using Repositories;
using Utils;

namespace JWT;

public interface JWTException;
public class JWTLoginExpired: Exception, JWTException;
public class JWTInvalidOrMissingToken: Exception, JWTException;
public class JWTInvalidUserOrToken: Exception, JWTException;

public static class JWTService {

    static string BEARER = "Bearer ";
    static int BEARER_LENGTH = "Bearer ".Length;

    static byte[] secret = Encoding.UTF8.GetBytes(Base64Encode("1234#@!"));

    public class Header {
        public string alg {get; set;} = "HS256";
        public string typ {get; set;} = "JWT";
    }

    public class Payload {
        public string Id {get; set;}
        public string Username {get; set;}
        public string Organization{get; set;}
        public DateTime TokenExpirationUTC {get; set;} = DateTime.UtcNow.AddMinutes(15);
        public DateTime LoginExpirationUTC {get; set;} = DateTime.UtcNow.AddDays(10);
    }

    public class JWTToken {
        public Header header {get; set;}
        public Payload payload {get; set;}
        public string signature {get; set;}

        public string token {get; set;}
    }

    public static string Base64Encode(string plainText) 
    {
        var plainTextBytes = System.Text.Encoding.UTF8.GetBytes(plainText);
        return System.Convert.ToBase64String(plainTextBytes);
    }

    public static string Base64Encode(byte[] bytes) 
    {
        return System.Convert.ToBase64String(bytes);
    }

    public static string Base64Decode(string base64EncodedData) 
    {
        var base64EncodedBytes = System.Convert.FromBase64String(base64EncodedData);
        return System.Text.Encoding.UTF8.GetString(base64EncodedBytes);
    }

    public static string createJWTToken(Header header, Payload payload){
        var headerSerializedAndEncrypted = Utils.EncryptionUtils
            .Encrypt(JsonSerializer.Serialize(header));
        var payloadSerializedAndEncrypted = Utils.EncryptionUtils
            .Encrypt(JsonSerializer.Serialize(payload));

        var headerAndPayload = $"{headerSerializedAndEncrypted}.{payloadSerializedAndEncrypted}";    

        var alg = new HMACSHA256(secret);
        var hash = alg.ComputeHash(Encoding.UTF8.GetBytes(headerAndPayload));

        var computedSignature = Base64Encode(hash);

        return $"{headerAndPayload}.{computedSignature}";    
    }
    
    public static void LogOut(HttpContext ctx){
        ctx.Response.Headers["logoff"] = "true";
        ctx.Response.Cookies.Delete("auth_token");        
    }

    public static JWTToken? getJWTTokenFromHttpContext(HttpContext httpCtx){
        var bearer = httpCtx.Request.Headers.Authorization.FirstOrDefault();
        var fromCookie = false;

        if(bearer == null || !bearer.StartsWith(BEARER)){
            var cookie = httpCtx.Request.Cookies["auth_token"];

            if(string.IsNullOrEmpty(cookie)){
                return null;
            }

            fromCookie = true;
            bearer = HttpUtility.UrlDecode(cookie.ToString());
        }   

        if(string.IsNullOrEmpty(bearer)){
            return null;
        }

        return validateJWTToken(fromCookie ? bearer : bearer.Substring(BEARER_LENGTH));
    }

    public static JWTToken? validateJWTToken(string token){
        var parts = token.Split(".");

        if(parts.Length < 3){
            return null;
        }

        try {
            var header = parts[0];
            var payload = parts[1];

            var headerDecrypted = Utils.EncryptionUtils.Decrypt(header);
            var payloadDecrypted = Utils.EncryptionUtils.Decrypt(payload);

            if(headerDecrypted == null || payloadDecrypted == null){
                return null;
            }

            var signature = parts[2];

            var headerAndPayload = $"{header}.{payload}";    

            var alg = new HMACSHA256(secret);
            var hash = alg.ComputeHash(Encoding.UTF8.GetBytes(headerAndPayload));

            var computedSignature = Base64Encode(hash);

            if(computedSignature.CompareTo(signature) != 0){
                return null;
            }
            
            return new JWTToken {
                header = JsonSerializer.Deserialize<Header>(headerDecrypted),
                payload = JsonSerializer.Deserialize<Payload>(payloadDecrypted),
                signature = computedSignature,
                token = token
            };
        } catch (Exception e) {
            return null;
        }

    }

    public static async Task<ITry<JWTToken>> isSignedIn(HttpContext ctx, 
        UserRepository UserRepository){

        var t = JWTService.getJWTTokenFromHttpContext(ctx);

        if(t == null){
            return new FailedTry<JWTToken>(new JWTInvalidOrMissingToken());
        }

        var now = DateTime.UtcNow;

        // Requires new signin to be able to proceed...
        if(t.payload.LoginExpirationUTC.CompareTo(now) < 0){
            JWTService.LogOut(ctx);
            return new FailedTry<JWTToken>(new JWTLoginExpired());
        }

        // If token expired, generates a new one...
        if(t.payload.TokenExpirationUTC.CompareTo(now) < 0){

            // Checks if user is still active in the service...
            var data = await UserRepository.getUser(t.payload.Username);

            if(data == null || !data.GetValue<bool>("active")){
                return new FailedTry<JWTToken>(new JWTInvalidUserOrToken());
            }

            var header = new JWT.JWTService.Header();

            var payload = new JWT.JWTService.Payload {
                Username = t.payload.Username,
                LoginExpirationUTC = now.AddDays(10),
                TokenExpirationUTC = now.AddMinutes(2),
                Id = System.Guid.NewGuid().ToString(),
                Organization = "myorg"
            };

            var token = JWT.JWTService.createJWTToken(header, payload);

            ctx.Response.Headers.Authorization = $"Bearer {token}";
            ctx.Response.Headers["X-JWT"] = token;
            ctx.Response.Cookies.Append("auth_token", HttpUtility.UrlEncode(token));
            
            return new SuccessTry<JWTToken>(validateJWTToken(token));
        }

        return new SuccessTry<JWTToken>(t);
    }

}