Post
Ask Question

Consuming JWT from Giraffe

Introduction 

 
Say we have an endpoint that must perform an action only if one has elevated permissions (i.e. delete some entity).
  1. let delete (id: string) =  
  2.     fun (next: HttpFunc) (httpContext : HttpContext) ->  
  3.     let result =  
  4.         AuthApi.authorize httpContext  
  5.         |> Result.bind (fun _ -> ElasticAdapter.deleteRoute id)  
  6.     match result with  
  7.     | Ok _ -> text "" next httpContext  
  8.     | Error "ItemNotFound" -> RequestErrors.BAD_REQUEST "" next httpContext  
  9.     | Error "Forbidden" -> RequestErrors.FORBIDDEN "" next httpContext  
  10.     | Error _ -> ServerErrors.INTERNAL_ERROR "" next httpContext  
Note that in a discriminated union we match multiple error cases, and one of them is a Forbidden case
Now let's have a look at the code of the authorize method inside AuthApi
  1. let authorize (httpContext : HttpContext) =  
  2.     let authorizationHeader = httpContext.GetRequestHeader "Authorization"  
  3.     let authorizationResult =  
  4.         authorizationHeader  
  5.         |> Result.bind JwtValidator.validateToken  
  6.     authorizationResult  
 And here's the JtwValidator
  1. module JwtValidator  
  2.   
  3. open Microsoft.IdentityModel.Tokens  
  4. open System.Text  
  5. open System.IdentityModel.Tokens.Jwt  
  6. open System  
  7.   
  8. let key = "<your key>"  
  9.   
  10. let createValidationParameters =  
  11.     let validationParameters = TokenValidationParameters()  
  12.     validationParameters.ValidateAudience <- false  
  13.     validationParameters.ValidateLifetime <- true  
  14.     validationParameters.ValidateIssuer <- false  
  15.     validationParameters.IssuerSigningKey <- SymmetricSecurityKey(Encoding.UTF8.GetBytes(key))  
  16.     validationParameters  
  17.   
  18. let validateToken (token: string) =   
  19.     try  
  20.         let tokenHandler = JwtSecurityTokenHandler()  
  21.         let validationParameters = createValidationParameters  
  22.         let mutable resToken : SecurityToken = null    
  23.         tokenHandler.ValidateToken(token, validationParameters, &resToken)  
  24.         |> ignore  
  25.         Result.Ok()  
  26.     with  
  27.     | _ -> Result.Error "Forbidden"