JWT Bearer Authentication

Build and run:

make

HS256:

This path signs and verifies JWTs with the shared secret from main.c.

curl -i http://127.0.0.1:8000/login-hs256
TOKEN=$(curl -s http://127.0.0.1:8000/login-hs256 | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
curl -i -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/

txt

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 47         

{"sub":"admin","scope":"dash:read dash:write"}

scope here is a JSON string value containing a space-delimited permission list; as an example.

ES256 (Requires MG_TLS_BUILTIN):

This path parses the EC private key from main.c, signs the JWT with it, and derives the public key for verification to keep the example self-contained.

curl -i http://127.0.0.1:8000/login-es256
TOKEN=$(curl -s http://127.0.0.1:8000/login-es256 | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
curl -i -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8000/

txt

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 36         

{"sub":"admin","scope":"dash:read"}

scope here is a JSON string value containing a space-delimited permission list; as an example.

Unauthorized access attempt example

curl -i -H "Authorization: Bearer bad.token.here" http://127.0.0.1:8000/

txt

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer
Content-Length: 13         

Unauthorized