`jwt_checker_claim_get` does not appear to work

[godmar]

How is jwt_checker_claim_get supposed to work? It expected it to return the value of a claim, but it always returns NULL.
The code accesses c.payload when it should be looking in the .claims json_t of the jwt_checker object, IMO.

I also did not see any unit tests for this function, and because of the use of preprocessor macros the code is nearly unreadable.

[benmcollins]

Examples are in tests/jwt_checker.c:

ret = jwt_checker_claim_set(checker, JWT_CLAIM_AUD, "employees");
ck_assert_int_eq(ret, 0);

out = jwt_checker_claim_get(checker, JWT_CLAIM_AUD);
ck_assert_ptr_nonnull(out);
ck_assert_str_eq(out, "employees");

jwt_checker_claim_get() only accepts JWT_CLAIM_ISS, JWT_CLAIM_AUD, or JWT_CLAIM_SUB.

If you want to check less common claims, then use:

/**
 * @brief Get a value from the claims of a JWT
 *
 * @param jwt Pointer to a jwt_t token, previously created with jwt_create()
 * @param value A jwt_value_t structure with relevant actions filled in
 * @return A jwt_value_error_t value, JWT_VALUE_ERR_NONE being success. The
 *  value.error field will match this return value.
 */
JWT_EXPORT
jwt_value_error_t jwt_claim_get(jwt_t *jwt, jwt_value_t *value);

Examples in the same file (also see jwt_header_get() as the two operate the same):

jwt_set_GET_STR(&jval, "alg");
err = jwt_header_get(jwt, &jval);
ck_assert_int_eq(err, JWT_VALUE_ERR_NONE);
ck_assert_int_eq(jval.error, JWT_VALUE_ERR_NONE);
ck_assert_ptr_nonnull(jval.str_val);
ck_assert_str_eq(jval.str_val, "none");

jwt_set_GET_INT(&jval, "iat");
err = jwt_claim_get(jwt, &jval);
ck_assert_int_eq(err, JWT_VALUE_ERR_NOEXIST);
ck_assert_int_eq(jval.error, JWT_VALUE_ERR_NOEXIST);
ck_assert_int_eq(jval.int_val, 0);

Lastly, c.payload is correct as that is the json_t object for the JWT payload (just like c.headers). The c.claims is a bitwise OR of jwt_claims_t that are used at validation or generation. These are set internally using various other functions. E.g. jwt_builder_enable_iat() will set or unset JWT_CLAIM_IAT so that when a token is generated, it can create the "iat" claim.

[godmar]

Thank you. Here's my test:

#include <jwt.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <time.h>
#include <errno.h>
#include <assert.h>
#include <unistd.h>
#include <jansson.h>

char *jwsk =
"{"
"  \"keys\": ["
"    {"
"      \"kty\": \"oct\","
"      \"alg\": \"HS256\","
"      \"k\": \"c3VwZXJzdXBlcnN1cGVyc2VjcmV0IGtleSBmb3IgZmFsbDIwMjU=\""
"    }"
"  ]"
"}";

int
main()
{
    // a valid jwt with a sub claim
    char *token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."
            "eyJleHAiOjE3NjM2OTU5NzksImlhdCI6MTc2MzYwOTU3OSwic3ViIjoidXNlcjAifQ."
            "3AR9gT4DvEooIfhpS1gWHjZqYVOblK0xg43ViomkE9A";

    jwt_checker_t *token_checker  = jwt_checker_new();
    jwk_set_t *keyset = jwks_create(jwsk);
    const jwk_item_t *key = jwks_item_get(keyset, 0);     // get first key
    int rc2 = jwt_checker_setkey(token_checker, JWT_ALG_HS256, key);
    assert (rc2 == 0);

    rc2 = jwt_checker_verify(token_checker, token);
    assert (rc2 == 0);
    const char *sub = jwt_checker_claim_get(token_checker, JWT_CLAIM_SUB);
    printf ("The value of the `sub` claim %s\n", sub);
}

It outputs null, I would have expected to get user0.

[benmcollins]

Ah, I see. You should do this:

jwt_checker_claim_set(token_checker, JWT_CLAIM_SUB, "user0");
...
rc2 = jwt_checker_verify(token_checker, token);
assert (rc2 == 0);

In this way, the verification would make sure the JWT contained a "sub" claim and that this claim was equal to "user0". The return value of jwt_checker_verify() would return non-zero if it does not meet this requirement.

This is, obviously, only useful if this requirement doesn't change from one token to the next.

In order to validate the contents of a JWT on-the-fly, you would instead use a callback. In tests/jwt_checker.c look for START_TEST(verify_wcb) which uses __verify_wcb().

This allows a more dynamic verification of claims and gets called during jwt_checker_verify() so that if your callback returns non-zero, so does this function.

[godmar]

Ok, thank you.

Also, I found that jwt_claim_get doesn't return ownership of the claim, so if the callback stores for instance jval.str_val it becomes dangling after the verifier succeeds.

On the other hand, if the claim is a JSON object, will the caller obtain ownership? A comment in code If things failed, it means we're responsible for this ref makes me think so.

[godmar]

Also, what is the equivalent of jwt_get_grants_json in version 3.0?

Is it:

  jwt_set_GET_JSON(&jval, NULL);
  jwt_claim_get(jwt, &jval);

?
PS: this seems to work, but oddly enough, I appear to have ownership of the returned jval.str_val without needing to strdup it. Intended?

[benmcollins]

The example you show is the way to get all grants in JSON string format.

As for GET_JSON, you really want to access jval.json_val which you do have ownership of (hence the char * and not const char * designation as with jval.str_val).

Please see notes in https://libjwt.io/group__jwt__helpers__get__grp.html