Add option to verify JWT tokens in the HTTP Authorization header

The RSA public key against which the JWT tokens are verified can be set
either via a configuration file setting, or an environment variable,
with the latter having the higher priority.

copy vss-server-config.toml

remove ca-certificates

rever removal of ca-certificates

Author: tankyleo

rust/Dockerfile

@@ -32,14 +32,7 @@ WORKDIR /app
 COPY --from=builder /build/target/release/vss-server /app/vss-server
 
 # Copy default configuration file
-#COPY server/vss-server-config.toml /app/vss-server-config.toml
-
-# Environment variables for PostgreSQL connection
-#ENV VSS_POSTGRESQL_USERNAME=postgres
-#ENV VSS_POSTGRESQL_PASSWORD=YOU_MUST_CHANGE_THIS_PASSWORD
-#ENV VSS_POSTGRESQL_HOST=postgres
-#ENV VSS_POSTGRESQL_PORT=5432
-#ENV VSS_POSTGRESQL_DATABASE=postgres
+COPY server/vss-server-config.toml /app/vss-server-config.toml
 
 EXPOSE 8080
 

rust/auth-impls/src/lib.rs

@@ -43,9 +43,11 @@ pub(crate) struct Claims {
 const BEARER_PREFIX: &str = "Bearer ";
 
 impl JWTAuthorizer {
-	/// Create new instance of [`JWTAuthorizer`]
-	pub async fn new(jwt_issuer_key: DecodingKey) -> Self {
-		Self { jwt_issuer_key }
+	/// Creates a new instance of [`JWTAuthorizer`], fails on failure to parse the PEM formatted RSA public key
+	pub async fn new(rsa_pem: &str) -> Result<Self, String> {
+		let jwt_issuer_key =
+			DecodingKey::from_rsa_pem(rsa_pem.as_bytes()).map_err(|e| e.to_string())?;
+		Ok(Self { jwt_issuer_key })
 	}
 }
 
@@ -76,7 +78,7 @@ mod tests {
 	use crate::JWTAuthorizer;
 	use api::auth::Authorizer;
 	use api::error::VssError;
-	use jsonwebtoken::{encode, Algorithm, DecodingKey, EncodingKey, Header};
+	use jsonwebtoken::{encode, Algorithm, EncodingKey, Header};
 	use serde::{Deserialize, Serialize};
 	use std::collections::HashMap;
 	use std::time::SystemTime;
@@ -134,7 +136,7 @@ mod tests {
 		)
 		.expect("Failed to create Encoding Key.");
 
-		let decoding_key = DecodingKey::from_rsa_pem(
+		let decoding_key = String::from(
 			"-----BEGIN PUBLIC KEY-----\
 			MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAysGpKU+I9i9b+QZSANu/\
 			ExaA6w4qiQdFZaXeReiz49r1oDfABwKIFW9gK/kNnrnL9H8P+pYfj7jqUJ/glmgq\
@@ -143,12 +145,10 @@ mod tests {
 			8YsTa5piV8KgJpG/rwYTGXuu3lcCmnWwjmbeDq1zFFrCDDVkaIHkGJgRuFIDPXaH\
 			yUw5H2HvKlP94ySbvTDLXWZj6TyzHEHDbstqs4DgvurB/bIhi/dQ7zK3EIXL8KRB\
 			hwIDAQAB\
-			-----END PUBLIC KEY-----"
-				.as_bytes(),
-		)
-		.expect("Failed to create Decoding Key.");
+			-----END PUBLIC KEY-----",
+		);
 
-		let jwt_authorizer = JWTAuthorizer::new(decoding_key).await;
+		let jwt_authorizer = JWTAuthorizer::new(&decoding_key).await.unwrap();
 
 		let valid_jwt_token =
 			encode(&Header::new(Algorithm::RS256), &claims, &valid_encoding_key).unwrap();

rust/server/src/main.rs

@@ -10,19 +10,20 @@
 #![deny(missing_docs)]
 
 use std::net::SocketAddr;
+use std::sync::Arc;
 
 use tokio::net::TcpListener;
 use tokio::signal::unix::SignalKind;
 
 use hyper::server::conn::http1;
 use hyper_util::rt::TokioIo;
 
-use crate::vss_service::VssService;
 use api::auth::{Authorizer, NoopAuthorizer};
 use api::kv_store::KvStore;
 use auth_impls::{DecodingKey, JWTAuthorizer};
 use impls::postgres_store::{Certificate, PostgresPlaintextBackend, PostgresTlsBackend};
-use std::sync::Arc;
+use util::config::{Config, ServerConfig};
+use vss_service::VssService;
 
 mod util;
 mod vss_service;
@@ -36,22 +37,21 @@ fn main() {
 		std::process::exit(1);
 	}
 
-	let config = match util::config::load_config(&args[1]) {
-		Ok(cfg) => cfg,
-		Err(e) => {
-			eprintln!("Failed to load configuration: {}", e);
-			std::process::exit(1);
-		},
-	};
-
-	let addr: SocketAddr =
-		match format!("{}:{}", config.server_config.host, config.server_config.port).parse() {
-			Ok(addr) => addr,
+	let Config { server_config: ServerConfig { host, port }, jwt_auth_config, postgresql_config } =
+		match util::config::load_config(&args[1]) {
+			Ok(cfg) => cfg,
 			Err(e) => {
-				eprintln!("Invalid host/port configuration: {}", e);
+				eprintln!("Failed to load configuration: {}", e);
 				std::process::exit(1);
 			},
 		};
+	let addr: SocketAddr = match format!("{}:{}", host, port).parse() {
+		Ok(addr) => addr,
+		Err(e) => {
+			eprintln!("Invalid host/port configuration: {}", e);
+			std::process::exit(1);
+		},
+	};
 
 	let runtime = match tokio::runtime::Builder::new_multi_thread().enable_all().build() {
 		Ok(runtime) => Arc::new(runtime),

rust/server/src/util/config.rs

@@ -3,6 +3,7 @@ use serde::Deserialize;
 #[derive(Deserialize)]
 pub(crate) struct Config {
 	pub(crate) server_config: ServerConfig,
+	pub(crate) jwt_auth_config: Option<JwtAuthConfig>,
 	pub(crate) postgresql_config: Option<PostgreSQLConfig>,
 	pub(crate) sentry_config: Option<SentryConfig>,
 }
@@ -39,6 +40,11 @@ pub(crate) struct ServerConfig {
 	pub(crate) rsa_pub_file_path: Option<String>,
 }
 
+#[derive(Deserialize)]
+pub(crate) struct JwtAuthConfig {
+	pub(crate) rsa_pem: String,
+}
+
 #[derive(Deserialize)]
 pub(crate) struct PostgreSQLConfig {
 	pub(crate) username: Option<String>, // Optional in TOML, can be overridden by env

rust/server/vss-server-config.toml

@@ -3,6 +3,21 @@ host = "127.0.0.1"
 port = 8080
 # rsa_pub_file_path = "rsa_public_key.pem" # Uncomment to verify JWT tokens in the HTTP Authorization header
 
+# Uncomment the table below to verify JWT tokens in the HTTP Authorization header against the given RSA public key,
+# can be overridden by env var `VSS_JWT_RSA_PEM`
+# [jwt_auth_config]
+# rsa_pem = """
+# -----BEGIN PUBLIC KEY-----
+# MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAstPJs4ut+tFAI0qrOyGt
+# /3FN5jWc5gLv/j9Rc6lgr4hm7lyR05PU/G+4rfxdXGNyGTlQ6dRqcVy78CjxWz9f
+# 8l08EKLERPh8JhE5el6vr+ehWD5iQxSP3ejpx0Mr977fKMNKg6jlFiL+y50hOEp2
+# 6iN9QzZQjLxotDT3aQvbCA/DZpI+fV6WKDKWGS+pZGDVgOz5x/RcStJQXxkX3ACK
+# WhVdrtN3h6mHlhIt7ZIqVvQmY4NL03QPyljt13sYHoiFaoxINF/funBMCjrfSLcB
+# ko1rWE2BWdOrFqi27RtBs5AHOSAWXuz/2SUGpFuTQuJi7U68QUfjKeQO46JpQf+v
+# kQIDAQAB
+# -----END PUBLIC KEY-----
+# """
+
 [postgresql_config]
 username = "postgres"  # Optional in TOML, can be overridden by env var `VSS_POSTGRESQL_USERNAME`
 password = "postgres"  # Optional in TOML, can be overridden by env var `VSS_POSTGRESQL_PASSWORD`