Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Switch to Microsoft.IdentityModel.JsonWebTokens package #7269

Merged
merged 2 commits into from
Jul 18, 2024
Merged

Switch to Microsoft.IdentityModel.JsonWebTokens package #7269

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
058f4d6
Switch to Microsoft.IdentityModel.JsonWebTokens package
rubo Jul 17, 2024
f39f7a6
Optimize Kute JWT key usage
rubo Jul 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/Nethermind/Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
<PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="8.0.0" />
<PackageVersion Include="Microsoft.Extensions.ObjectPool" Version="8.0.7" />
<PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.0.0" />
<PackageVersion Include="Microsoft.IO.RecyclableMemoryStream" Version="3.0.1" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
<PackageVersion Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.21.0" />
Expand Down Expand Up @@ -70,12 +71,11 @@
<PackageVersion Include="Shouldly" Version="4.2.1" />
<PackageVersion Include="Snappier" Version="1.1.6" />
<PackageVersion Include="System.Configuration.ConfigurationManager" Version="8.0.0" />
<PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.0.0" />
<PackageVersion Include="System.IO.Pipelines" Version="8.0.0" />
<PackageVersion Include="System.Linq.Async" Version="6.0.1" />
<PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="8.0.0" />
<PackageVersion Include="TestableIO.System.IO.Abstractions.TestingHelpers" Version="21.0.26" />
<PackageVersion Include="TestableIO.System.IO.Abstractions.Wrappers" Version="21.0.26" />
<PackageVersion Include="Websocket.Client" Version="5.1.2" />
</ItemGroup>
</Project>
</Project>
2 changes: 1 addition & 1 deletion src/Nethermind/Nethermind.Core/Nethermind.Core.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,10 @@
<ItemGroup>
<PackageReference Include="FastEnum" />
<PackageReference Include="Microsoft.Extensions.ObjectPool" />
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
<PackageReference Include="Nethermind.Crypto.SecP256k1" />
<PackageReference Include="Nethermind.Numerics.Int256" />
<PackageReference Include="TestableIO.System.IO.Abstractions.Wrappers" />
<PackageReference Include="System.IdentityModel.Tokens.Jwt" />
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
</ItemGroup>
<ItemGroup>
Expand Down
15 changes: 7 additions & 8 deletions tools/Nethermind.Tools.Kute/Auth/JwtAuth.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,8 @@
// SPDX-FileCopyrightText: 2023 Demerzel Solutions Limited
// SPDX-License-Identifier: LGPL-3.0-only

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using Microsoft.IdentityModel.Tokens;
using Microsoft.IdentityModel.JsonWebTokens;
using Nethermind.Tools.Kute.SecretProvider;
using Nethermind.Tools.Kute.SystemClock;

Expand Down Expand Up @@ -32,12 +31,12 @@ public JwtAuth(ISystemClock clock, ISecretProvider secretProvider)

private string GenerateAuthToken()
{
var signingKey = new SymmetricSecurityKey(_secret);
var credentials = new SigningCredentials(signingKey, SecurityAlgorithms.HmacSha256);
var claims = new[] { new Claim(JwtRegisteredClaimNames.Iat, _clock.UtcNow.ToUnixTimeSeconds().ToString(), ClaimValueTypes.Integer64) };
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might be reintroducing #6936. @stdevMac please check again with Reth or by following that PR discussion.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's failing to compile:

MSBuild version 17.8.5+b5265ef37 for .NET
  Determining projects to restore...
  Restored /root/nethermind/tools/Nethermind.Tools.Kute/Nethermind.Tools.Kute.csproj (in 3.61 sec).
/root/nethermind/tools/Nethermind.Tools.Kute/JsonRpcMethodFilter/ComposedJsonRpcMethodFilter.cs(18,18): error CS1061: 'IEnumerable<IJsonRpcMethodFilter>' does not contain a definition for 'IsNullOrEmpty' and no accessible extension method 'IsNullOrEmpty' accepting a first argument of type 'IEnumerable<IJsonRpcMethodFilter>' could be found (are you missing a using directive or an assembly reference?) [/root/nethermind/tools/Nethermind.Tools.Kute/Nethermind.Tools.Kute.csproj]

Build FAILED.

/root/nethermind/tools/Nethermind.Tools.Kute/JsonRpcMethodFilter/ComposedJsonRpcMethodFilter.cs(18,18): error CS1061: 'IEnumerable<IJsonRpcMethodFilter>' does not contain a definition for 'IsNullOrEmpty' and no accessible extension method 'IsNullOrEmpty' accepting a first argument of type 'IEnumerable<IJsonRpcMethodFilter>' could be found (are you missing a using directive or an assembly reference?) [/root/nethermind/tools/Nethermind.Tools.Kute/Nethermind.Tools.Kute.csproj]

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@emlautarom1 The updated code has been tested to ensure it generates the same token as it was with the replaced package.

var token = new JwtSecurityToken(claims: claims, signingCredentials: credentials);
var handler = new JwtSecurityTokenHandler();
var handler = new JsonWebTokenHandler { SetDefaultTimesOnTokenCreation = false };

return handler.WriteToken(token);
return handler.CreateToken(new SecurityTokenDescriptor
{
IssuedAt = _clock.UtcNow.UtcDateTime,
SigningCredentials = new(new SymmetricSecurityKey(_secret), SecurityAlgorithms.HmacSha256)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we cache SymmetricSecurityKey instance?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried not to make any other changes but replace the API as I don't know much about Kute. But the suggested change is small enough, so applied in the commit below.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There should be no need for caching since we're already caching the JWT generation. By default, this code will be executed once per minute.

});
}
}
2 changes: 1 addition & 1 deletion tools/Nethermind.Tools.Kute/Nethermind.Tools.Kute.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
<PackageReference Include="App.Metrics" Version="4.3.0" />
<PackageReference Include="CommandLineParser" Version="2.9.1" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="7.1.2" />
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.0.0" />
<PackageReference Include="System.Linq.Async" Version="6.0.1" />
</ItemGroup>

Expand Down