implement basic authorization with auth0

Author: byron-okta

Gemfile

@@ -31,3 +31,5 @@ end
 group :development do
   gem 'dotenv-rails'
 end
+
+gem 'jwt', '~> 2.5'

Gemfile.lock

@@ -89,6 +89,7 @@ GEM
     irb (1.7.4)
       reline (>= 0.3.6)
     json (2.6.3)
+    jwt (2.7.1)
     language_server-protocol (3.17.0.3)
     loofah (2.21.3)
       crass (~> 1.0.2)
@@ -192,6 +193,7 @@ DEPENDENCIES
   bootsnap
   debug
   dotenv-rails
+  jwt (~> 2.5)
   puma (~> 5.0)
   rack-cors
   rails (~> 7.0.3, >= 7.0.3.1)

NOTICE

@@ -72,6 +72,7 @@ ________________________________________________________________________________
 - io-console (0.6.0) [Ruby, BSD-2-Clause]
 - irb (1.7.4) [BSD-2-Clause]
 - json (2.6.3) [Ruby]
+- jwt (2.7.1) [MIT]
 - language_server-protocol (3.17.0.3) [MIT]
 - loofah (2.21.3) [MIT]
 - mail (2.8.1) [MIT]
@@ -1008,6 +1009,24 @@ Ruby
    6. THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 
 
+--------------------------------------------------------------------------------
+Package Title: jwt (2.7.1)
+--------------------------------------------------------------------------------
+
+* Declared Licenses *
+MIT
+
+
+Copyright (c) 2011 Jeff Lindsay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+
 --------------------------------------------------------------------------------
 Package Title: language_server-protocol (3.17.0.3)
 --------------------------------------------------------------------------------
@@ -7056,6 +7075,17 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
 
+* MIT *
+
+Copyright (c) 2011 Jeff Lindsay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
 * MIT *
 
 Copyright (c) 2011-2013  Peter Zotov <whitequark@whitequark.org>
@@ -8911,6 +8941,10 @@ purpose. It is provided "as is" without express or implied warranty.
 
 This is a catch-all license used when we find many different proprietary licenses.
 
+* public-domain *
+
+No license text available
+
 
 --------------------------------------------------------------------------------
 --------------------------------------------------------------------------------

README.md

@@ -1,25 +1,11 @@
-# Rails/Ruby: Starter API Code Sample
+# Rails/Ruby: API Basic Access Control Code Sample
 
-This Ruby code sample demonstrates how to build an API server using Rails that is secure by design.
+This Ruby code sample demonstrates **how to implement authorization** in Rails API servers using Auth0.
 
-Visit the ["Rails/Ruby Code Samples: API Security in Action"](https://developer.auth0.com/resources/code-samples/api/railss) section of the ["Auth0 Developer Resources"](https://developer.auth0.com/resources) to explore how you can secure Rails applications written in Ruby by implementing endpoint protection and authorization with Auth0.
+This code sample is part of the ["Auth0 Developer Resources"](https://developer.auth0.com/resources), a place where you can explore the authentication and authorization features of the Auth0 Identity Platform.
+
+Visit the ["Rails/Ruby Code Sample: Authorization For Basic APIs"](https://developer.auth0.com/resources/code-samples/api/rails/basic-authorization) page for instructions on how to configure and run this code sample and how to integrate it with a Single-Page Application (SPA) of your choice.
 
 ## Why Use Auth0?
 
 Auth0 is a flexible drop-in solution to add authentication and authorization services to your applications. Your team and organization can avoid the cost, time, and risk that come with building your own solution to authenticate and authorize users. We offer tons of guidance and SDKs for you to get started and [integrate Auth0 into your stack easily](https://developer.auth0.com/resources/code-samples/full-stack).
-
-## Set Up and Run the Rails Project
-
-Install the project dependencies:
-
-```bash
-bundle install
-```
-
-Run the application:
-
-```bash
-bundle exec rails s
-```
-
-Visit [`http://localhost:6060/`](http://localhost:6060/) to access the starter application.

app/controllers/api/base_controller.rb

@@ -2,6 +2,8 @@
 
 module Api
   class BaseController < ApplicationController
+    include Secured
+
     rescue_from StandardError do |e|
       render json: { message: e.message }, status: :internal_server_error
     end

app/controllers/api/messages_controller.rb

@@ -2,6 +2,8 @@
 
 module Api
   class MessagesController < BaseController
+    before_action :authorize, except: [:public]
+
     def admin
       render json: Message.admin_message
     end

app/controllers/concerns/secured.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Secured
+  extend ActiveSupport::Concern
+
+  REQUIRES_AUTHENTICATION = { message: 'Requires authentication' }.freeze
+  BAD_CREDENTIALS = {
+    message: 'Bad credentials'
+  }.freeze
+  MALFORMED_AUTHORIZATION_HEADER = {
+    error: 'invalid_request',
+    error_description: 'Authorization header value must follow this format: Bearer access-token',
+    message: 'Bad credentials'
+  }.freeze
+
+  def authorize
+    token = token_from_request
+
+    return if performed?
+
+    validation_response = Auth0Client.validate_token(token)
+
+    return unless (error = validation_response.error)
+
+    render json: {message: error.message}, status: error.status
+  end
+
+  private
+
+  def token_from_request
+    authorization_header_elements = request.headers['Authorization']&.split
+
+    render json: REQUIRES_AUTHENTICATION, status: :unauthorized and return unless authorization_header_elements
+
+    unless authorization_header_elements.length == 2
+      render json: MALFORMED_AUTHORIZATION_HEADER, status: :unauthorized and return
+    end
+
+    scheme, token = authorization_header_elements
+
+    render json: BAD_CREDENTIALS, status: :unauthorized and return unless scheme.downcase == 'bearer'
+
+    token
+  end
+end

app/lib/auth0_client.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'jwt'
+require 'net/http'
+
+class Auth0Client
+
+  # Auth0 Client Objects
+  Error = Struct.new(:message, :status)
+  Response = Struct.new(:decoded_token, :error)
+
+  # Helper Functions
+  def self.domain_url
+    "https://#{Rails.configuration.auth0.domain}/"
+  end
+
+  def self.decode_token(token, jwks_hash)
+    JWT.decode(token, nil, true, {
+                 algorithm: 'RS256',
+                 iss: domain_url,
+                 verify_iss: true,
+                 aud: Rails.configuration.auth0.audience.to_s,
+                 verify_aud: true,
+                 jwks: { keys: jwks_hash[:keys] }
+               })
+  end
+
+  def self.get_jwks
+    jwks_uri = URI("#{domain_url}.well-known/jwks.json")
+    Net::HTTP.get_response jwks_uri
+  end
+
+  # Token Validation
+  def self.validate_token(token)
+    jwks_response = get_jwks
+
+    unless jwks_response.is_a? Net::HTTPSuccess
+      error = Error.new(message: 'Unable to verify credentials', status: :internal_server_error)
+      return Response.new(nil, error)
+    end
+
+    jwks_hash = JSON.parse(jwks_response.body).deep_symbolize_keys
+
+    decoded_token = decode_token(token, jwks_hash)
+
+    Response.new(decoded_token, nil)
+  rescue JWT::VerificationError, JWT::DecodeError => e
+    error = Error.new('Bad credentials', :unauthorized)
+    Response.new(nil, error)
+  end
+end

config/application.rb

@@ -20,7 +20,7 @@
 # you've limited to :test, :development, or :production.
 Bundler.require(*Rails.groups)
 
-module ApiRailsRubyHelloWorldCarla
+module ApiRailsRubyHelloWorld
   class Application < Rails::Application
     # Initialize configuration defaults for originally generated Rails version.
     config.load_defaults 7.0
@@ -40,6 +40,8 @@ class Application < Rails::Application
 
     config.exceptions_app = routes
 
+    config.auth0 = config_for(:auth0)
+
     config.action_dispatch.default_headers = {
       'X-Frame-Options' => 'deny',
       'X-XSS-Protection' => '0',

config/auth0.yml

@@ -0,0 +1,7 @@
+development:
+  domain: <%= ENV.fetch('AUTH0_DOMAIN') %>
+  audience: <%= ENV.fetch('AUTH0_AUDIENCE') %>
+
+production:
+  domain: <%= ENV.fetch('AUTH0_DOMAIN') %>
+  audience: <%= ENV.fetch('AUTH0_AUDIENCE') %>