How can I get the username from the JWT?

user_12440701 0
Viewed 10251

I have 2 microservices. An API gateway and microservices that send messages to customers. My API returns a JWT token after authentication. The username of the user is contained in the token.

        public String extractUsername(String token)
        {
            return extractClaim(token, Claims::getSubject);
        }
        public Date extractExpiration(String token)
        {
            return extractClaim(token, Claims::getExpiration);
        }
        public <T> T extractClaim(String token, Function<Claims,T> claimsResolver)
        {
            final Claims claims = extractAllClaims(token);
            return claimsResolver.apply(claims);
        }
        private Claims extractAllClaims(String token)
        {
            return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody();
        }
        private Boolean isTokenExpired(String token)
        {
            return extractExpiration(token).before(new Date());
        }
        public String generateToken(UserDetails userDetails)
        {
            Map<String,Object> claims =new HashMap<>();
            return createToken(claims,userDetails.getUsername());
        }
        private String createToken(Map<String, Object> claims, String subject)
        {
            return Jwts.builder().setClaims(claims).setSubject(subject).setIssuedAt(new Date(System.currentTimeMillis()))
                    .setExpiration(new Date(System.currentTimeMillis() + 1000*60*60*24*360))
                    .signWith(SignatureAlgorithm.HS256, SECRET_KEY).compact();
        }
        public Boolean validateToken(String token, UserDetails userDetails)
        {
            final String username = extractUsername(token);
            return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
        }

If I want to address my SendMessage microservice through the API gateway, he needs the username to send the message. I am currently passing on the username via Rest-Api. I would prefer that the SendMessage Microservice takes the username from the token. I have read that this works with the TokenEnhancer. But I have found no further information. Can someone tell me how I can do this or where I can find more information?

UPDATE

@GetMapping("/contacts/sms/{name}/{customer_phone_number}/{text}")
            public String sendSmsToCustomer(@PathVariable("name") String name,@PathVariable("customer_phone_number") String customer_phone_number, @PathVariable("text") String text) throws Exception
            {
            
String user= getUsernameFromToken(HttpServletRequest request);
            
            
            SmsSubmissionResponse responses = client.getSmsClient().submitMessage(new TextMessage(
                    name,
                    customer_phone_number,
                    text));
            for (SmsSubmissionResponseMessage response : responses.getMessages()) {
                System.out.println (response);
            }
        
            if (responses.getMessages().get(0).getStatus() == MessageStatus.OK) {
                String date=new SimpleDateFormat("yyyy.MM.dd - HH:mm:ss").format(new java.util.Date());
                    SQL_Connection.SaveDataInSmsDB(name, customer_phone_number, text,date);
                    return "Message sent successfully.";
                } else {
                    return "Message failed with error: " + responses.getMessages().get(0).getErrorText();
                }
            }

UPDATE 2

@GetMapping("/contacts/sms/{name}/{customer_phone_number}/{text}")
            public String sendSmsToCustomer(@RequestHeader(HEADER_STRING) HttpServletRequest request, @PathVariable("name") String name,@PathVariable("customer_phone_number") String customer_phone_number, @PathVariable("text") String text) throws Exception
            {
            String user= getUsernameFromToken(request);
            System.out.println(user);

{
    "timestamp": "2020-07-07T08:08:34.975+0000",
    "status": 400,
    "error": "Bad Request",
    "message": "Missing request header 'Authorization' for method parameter of type HttpServletRequest",
    "path": "/contacts/sms/segos/44256674/hallo%20Container%20kommt"
}
jwt spring-boot java
4 Answers
user_47917500

Use following to parse username from jwt token

 final String authHeader = request.getHeader("Authorization");
    String username = null;
    String jwt = null;

    if (authHeader != null && authHeader.startsWith("Bearer")) {
        jwt = authHeader.substring(7);
        username = jwtUtil.extractUsername(jwt);
    }
user_128419960

Via authentication.getName & principal.getName you can get username :

Try below code :

@Controller
@RequestMapping("/info")
public class GetNameController {

    @RequestMapping(value = "/name", method = RequestMethod.GET)
    public String getName(Authentication authentication, Principal principal) {
        System.out.println(authentication.getName());
        System.out.println(principal.getName());
        return "";
    }
}
user_45398380

After Authenticate you can send JWT Token through Overriding successfulAuthentication() method

Generate Token code:

@Override
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
        Authentication authResult) throws IOException, ServletException {
    String userName = ((User)authResult.getPrincipal()).getUsername();
    UserDto userDetails = userService.getUserDetailsByEmail(userName);
    
    // Generate JWO Token
    String token = Jwts.builder()
            .setSubject(userDetails.getUserId())
            .setExpiration(new Date(System.currentTimeMillis() + Long.parseLong(env.getProperty("token.expiration_time"))))
            .signWith(SignatureAlgorithm.HS512, env.getProperty("token.secret"))
            .compact();
    response.addHeader("token", token);
    response.addHeader("userId", userDetails.getUserId());
}

SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter{
    @Autowired
    private Environment env;
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        
        http.csrf().disable();
        http.headers().frameOptions().disable();
        http.authorizeRequests()
        .antMatchers(env.getProperty("api.h2console.url.path")).permitAll()
        .antMatchers(HttpMethod.POST, env.getProperty("api.registration.url.path")).permitAll()
        .antMatchers(HttpMethod.POST, env.getProperty("api.login.url.path")).permitAll()
        .anyRequest().authenticated();
        
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }   
}

After Getting request, It will authenticated using http.anyRequest().authenticated() method. Then it will call the follow authorization filter for authenticate the request.

AuthorizationFilter.java

public class AuthorizationFilter extends BasicAuthenticationFilter{

    Environment environment;
    
    public AuthorizationFilter(AuthenticationManager authenticationManager, Environment environment) {
        super(authenticationManager);
        this.environment = environment;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest req,HttpServletResponse res, FilterChain filter)
        throws IOException, ServletException{
        
        String authorizationHeader = req.getHeader(environment.getProperty("authorization.token.header.name"));
        
        if(authorizationHeader != null || 
                !authorizationHeader.startsWith(environment.getProperty("authorization.token.header.name.prefix"))) {
            filter.doFilter(req, res);
            
            return;
        }
        
        UsernamePasswordAuthenticationToken authentication = getAuthentication(req);
        
        SecurityContextHolder.getContext().getAuthentication();
        filter.doFilter(req, res);
    }

    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest req) {
            String authorizationHeader = req.getHeader(environment.getProperty("authorization.token.header.name"));
            
            if(authorizationHeader == null) {
                return null;
            }
            
            String token = authorizationHeader.replace(
                    environment.getProperty("authorization.token.header.name.prefix"), "");
            String userId = Jwts.parser()
                    .setSigningKey(environment.getProperty("token.secret"))
                    .parseClaimsJws(token)
                    .getBody()
                    .getSubject();
            if(userId == null) {
                return null;
            }
            
        return new UsernamePasswordAuthenticationToken(userId, null, new ArrayList<>());
    }
    
}

I hope this code will work for you

user_116971710
Related