Merge pull request vert-x#22 from vert-x3/feature/example-jwt

jwt example
vietj · Jun 5, 2015 · 60081ad · 60081ad
2 parents 0ebe697 + 860c8ef
commit 60081ad
Show file tree

Hide file tree

Showing 5 changed files with 129 additions and 19 deletions.
diff --git a/web-examples/README.adoc b/web-examples/README.adoc
@@ -155,27 +155,18 @@ was successful.
 Run the server either in your IDE or on the command line, then open your browser and hit
 link:http://localhost:8080 and click around the links
 
+== JWT example
 
+This example shows a basic single page application that contains an API that is protected by a JWT.
 
+The link:src/main/java/io/vertx/example/web/jwt/[Java jwt example]
 
+Requests to paths starting with `/api/` will require a JWT token, except the excluded `/api/newToken`. This exclusion is
+normaly used as the login end point, however in this example we are not focusing on secure login end points and we just
+return a new token for any request.
 
+The application contains a simple form where you can request some data from the API if there is no token loaded then the
+response is an `HTTP error 401`. When a token is loaded, then a successful response if received from the API.
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+Run the server either in your IDE or on the command line, then open your browser and hit
+link:http://localhost:8080 and click around the links
diff --git a/web-examples/pom.xml b/web-examples/pom.xml
@@ -38,6 +38,12 @@
       <version>${project.version}</version>
     </dependency>
 
+    <dependency>
+      <groupId>io.vertx</groupId>
+      <artifactId>vertx-auth-jwt</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+
     <dependency>
       <groupId>io.vertx</groupId>
       <artifactId>examples-utils</artifactId>

diff --git a/web-examples/src/main/java/io/vertx/example/web/jwt/Server.java b/web-examples/src/main/java/io/vertx/example/web/jwt/Server.java
@@ -0,0 +1,58 @@
+package io.vertx.example.web.jwt;
+
+import io.vertx.core.AbstractVerticle;
+import io.vertx.core.http.HttpHeaders;
+import io.vertx.core.json.JsonObject;
+import io.vertx.example.util.Runner;
+import io.vertx.ext.auth.AuthProvider;
+import io.vertx.ext.auth.jwt.JWTAuth;
+import io.vertx.ext.auth.jwt.JWTOptions;
+import io.vertx.ext.auth.shiro.ShiroAuth;
+import io.vertx.ext.auth.shiro.ShiroAuthRealmType;
+import io.vertx.ext.web.Router;
+import io.vertx.ext.web.handler.*;
+import io.vertx.ext.web.sstore.LocalSessionStore;
+
+/*
+ * @author <a href="mailto:[email protected]">Paulo Lopes</a>
+ */
+public class Server extends AbstractVerticle {
+
+  // Convenience method so you can run it in your IDE
+  public static void main(String[] args) {
+    Runner.runExample(Server.class);
+  }
+
+  @Override
+  public void start() throws Exception {
+
+    Router router = Router.router(vertx);
+
+    // Create a JWT Auth Provider
+    JWTAuth jwt = JWTAuth.create(new JsonObject()
+      .put("keyStoreType", "jceks")
+      .put("keyStoreURI", "classpath:///keystore.jceks")
+      .put("keyStorePassword", "secret"));
+
+    // protect the API
+    router.route("/api/*").handler(JWTAuthHandler.create(jwt, "/api/newToken"));
+
+    // this route is excluded from the auth handler
+    router.get("/api/newToken").handler(ctx -> {
+      ctx.response().putHeader(HttpHeaders.CONTENT_TYPE, "text/plain");
+      ctx.response().end(jwt.generateToken(new JsonObject(), new JWTOptions().setExpiresInSeconds(60)));
+    });
+
+    // this is the secret API
+    router.get("/api/protected").handler(ctx -> {
+      ctx.response().putHeader(HttpHeaders.CONTENT_TYPE, "text/plain");
+      ctx.response().end("a secret you should keep for yourself...");
+    });
+
+    // Serve the non private static pages
+    router.route().handler(StaticHandler.create());
+
+    vertx.createHttpServer().requestHandler(router::accept).listen(8080);
+  }
+}
+
diff --git a/web-examples/src/main/java/io/vertx/example/web/jwt/webroot/index.html b/web-examples/src/main/java/io/vertx/example/web/jwt/webroot/index.html
@@ -0,0 +1,55 @@
+<html>
+<head>
+    <script src="http://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
+</head>
+<body>
+
+<h1>Web site with public and private pages</h1>
+
+<br>
+<br>
+
+<div id="login">
+    <a href="#" id="generateToken">Get a Token</a>
+    <div id="token">Current token:</div>
+</div>
+
+<br>
+<br>
+
+<div id="test">
+    <a href="#" id="getProtected">Get Protected Resource</a>
+    <div id="protected"></div>
+</div>
+
+<script language="JavaScript">
+    $(document).ready(function () {
+        $('#generateToken').on('click', function () {
+            $.ajax({
+                url: '/api/newToken',
+                dataType: 'text',
+                success: function (text) {
+                    $('#token').html('Current Token: ' + text);
+                }
+            });
+        });
+
+        $('#getProtected').on('click', function () {
+            $.ajax({
+                url: '/api/protected',
+                dataType: 'text',
+                headers: {
+                    "Authorization": "Bearer " + $('#token').html().substring(15)
+                },
+                success: function (text) {
+                    $('#protected').html(text);
+                },
+                error: function (err) {
+                    $('#protected').html('Error: ' + err.toString());
+                }
+            });
+        });
+    });
+</script>
+</body>
+</html>
diff --git a/web-examples/src/main/resources/keystore.jceks b/web-examples/src/main/resources/keystore.jceks