Merge pull request #10 from dgrijalva/detailed_error

Updated error response from Parse to provide more detail

jwt.go

@@ -84,67 +84,107 @@ func (t *Token) SigningString() (string, error) {
 // Parse, validate, and return a token.
 // keyFunc will receive the parsed token and should return the key for validating.
 // If everything is kosher, err will be nil
-func Parse(tokenString string, keyFunc Keyfunc) (token *Token, err error) {
+func Parse(tokenString string, keyFunc Keyfunc) (*Token, error) {
 	parts := strings.Split(tokenString, ".")
 	if len(parts) == 3 {
-		token = &Token{Raw: tokenString}
+		var err error
+		token := &Token{Raw: tokenString}
 		// parse Header
 		var headerBytes []byte
 		if headerBytes, err = DecodeSegment(parts[0]); err != nil {
-			return
+			return token, &ValidationError{err: err.Error(), Errors: ValidationErrorMalformed}
 		}
 		if err = json.Unmarshal(headerBytes, &token.Header); err != nil {
-			return
+			return token, &ValidationError{err: err.Error(), Errors: ValidationErrorMalformed}
 		}
 
 		// parse Claims
 		var claimBytes []byte
 		if claimBytes, err = DecodeSegment(parts[1]); err != nil {
-			return
+			return token, &ValidationError{err: err.Error(), Errors: ValidationErrorMalformed}
 		}
 		if err = json.Unmarshal(claimBytes, &token.Claims); err != nil {
-			return
+			return token, &ValidationError{err: err.Error(), Errors: ValidationErrorMalformed}
 		}
 
 		// Lookup signature method
 		if method, ok := token.Header["alg"].(string); ok {
 			if token.Method = GetSigningMethod(method); token.Method == nil {
-				err = errors.New("Signing method (alg) is unavailable.")
-				return
+				return token, &ValidationError{err: "Signing method (alg) is unavailable.", Errors: ValidationErrorUnverifiable}
 			}
 		} else {
-			err = errors.New("Signing method (alg) is unspecified.")
-			return
-		}
-
-		// Check expiration times
-		now := TimeFunc().Unix()
-		if exp, ok := token.Claims["exp"].(float64); ok {
-			if now > int64(exp) {
-				err = errors.New("Token is expired")
-			}
-		}
-		if nbf, ok := token.Claims["nbf"].(float64); ok {
-			if now < int64(nbf) {
-				err = errors.New("Token is not valid yet")
-			}
+			return token, &ValidationError{err: "Signing method (alg) is unspecified.", Errors: ValidationErrorUnverifiable}
 		}
 
 		// Lookup key
 		var key []byte
 		if key, err = keyFunc(token); err != nil {
-			return
+			return token, &ValidationError{err: err.Error(), Errors: ValidationErrorUnverifiable}
+		}
+
+		// Check expiration times
+		vErr := &ValidationError{}
+		now := TimeFunc().Unix()
+		if exp, ok := token.Claims["exp"].(float64); ok {
+			if now > int64(exp) {
+				vErr.err = "Token is expired"
+				vErr.Errors |= ValidationErrorExpired
+			}
+		}
+		if nbf, ok := token.Claims["nbf"].(float64); ok {
+			if now < int64(nbf) {
+				vErr.err = "Token is not valid yet"
+				vErr.Errors |= ValidationErrorNotValidYet
+			}
 		}
 
 		// Perform validation
-		if err = token.Method.Verify(strings.Join(parts[0:2], "."), parts[2], key); err == nil {
-			token.Valid = true
+		if err = token.Method.Verify(strings.Join(parts[0:2], "."), parts[2], key); err != nil {
+			vErr.err = err.Error()
+			vErr.Errors |= ValidationErrorSignatureInvalid
 		}
 
-	} else {
-		err = errors.New("Token contains an invalid number of segments")
+		if vErr.valid() {
+			token.Valid = true
+			return token, nil
 		}
-	return
+
+		return token, vErr
+
+	} else {
+		return nil, &ValidationError{err: "Token contains an invalid number of segments", Errors: ValidationErrorMalformed}
+	}
+}
+
+// The errors that might occur when parsing and validating a token
+const (
+	ValidationErrorMalformed        uint32 = 1 << iota // Token is malformed
+	ValidationErrorUnverifiable                        // Token could not be verified because of signing problems
+	ValidationErrorSignatureInvalid                    // Signature validation failed
+	ValidationErrorExpired                             // Exp validation failed
+	ValidationErrorNotValidYet                         // NBF validation failed
+)
+
+// The error from Parse if token is not valid
+type ValidationError struct {
+	err    string
+	Errors uint32 // bitfield.  see ValidationError... constants
+}
+
+// Validation error is an error type
+func (e *ValidationError) Error() string {
+	if e.err == "" {
+		return "Token is invalid"
+	}
+	return e.err
+}
+
+// No errors
+func (e *ValidationError) valid() bool {
+	if e.Errors > 0 {
+		return false
+	}
+	return true
 }
 
 // Try to find the token in an http.Request.

jwt_test.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"reflect"
 	"testing"
+	"time"
 )
 
 var jwtTestData = []struct {
@@ -15,21 +16,63 @@ var jwtTestData = []struct {
 	tokenString     string
 	claims          map[string]interface{}
 	valid           bool
+	validationError *ValidationError
 }{
 	{
 		"basic",
 		"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJmb28iOiJiYXIifQ.FhkiHkoESI_cG3NPigFrxEk9Z60_oXrOT2vGm9Pn6RDgYNovYORQmmA0zs1AoAOf09ly2Nx2YAg6ABqAYga1AcMFkJljwxTT5fYphTuqpWdy4BELeSYJx5Ty2gmr8e7RonuUztrdD5WfPqLKMm1Ozp_T6zALpRmwTIW0QPnaBXaQD90FplAg46Iy1UlDKr-Eupy0i5SLch5Q-p2ZpaL_5fnTIUDlxC3pWhJTyx_71qDI-mAA_5lE_VdroOeflG56sSmDxopPEG3bFlSu1eowyBfxtu0_CuVd-M42RU75Zc4Gsj6uV77MBtbMrf4_7M_NUTSgoIF3fRqxrj0NzihIBg",
 		map[string]interface{}{"foo": "bar"},
 		true,
+		nil,
+	},
+	{
+		"basic expired",
+		"", // autogen
+		map[string]interface{}{"foo": "bar", "exp": float64(time.Now().Unix() - 100)},
+		false,
+		&ValidationError{Errors: ValidationErrorExpired},
+	},
+	{
+		"basic nbf",
+		"", // autogen
+		map[string]interface{}{"foo": "bar", "nbf": float64(time.Now().Unix() + 100)},
+		false,
+		&ValidationError{Errors: ValidationErrorNotValidYet},
+	},
+	{
+		"expired and nbf",
+		"", // autogen
+		map[string]interface{}{"foo": "bar", "nbf": float64(time.Now().Unix() + 100), "exp": float64(time.Now().Unix() - 100)},
+		false,
+		&ValidationError{Errors: ValidationErrorNotValidYet | ValidationErrorExpired},
 	},
 	{
 		"basic invalid",
 		"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJmb28iOiJiYXIifQ.EhkiHkoESI_cG3NPigFrxEk9Z60_oXrOT2vGm9Pn6RDgYNovYORQmmA0zs1AoAOf09ly2Nx2YAg6ABqAYga1AcMFkJljwxTT5fYphTuqpWdy4BELeSYJx5Ty2gmr8e7RonuUztrdD5WfPqLKMm1Ozp_T6zALpRmwTIW0QPnaBXaQD90FplAg46Iy1UlDKr-Eupy0i5SLch5Q-p2ZpaL_5fnTIUDlxC3pWhJTyx_71qDI-mAA_5lE_VdroOeflG56sSmDxopPEG3bFlSu1eowyBfxtu0_CuVd-M42RU75Zc4Gsj6uV77MBtbMrf4_7M_NUTSgoIF3fRqxrj0NzihIBg",
 		map[string]interface{}{"foo": "bar"},
 		false,
+		&ValidationError{Errors: ValidationErrorSignatureInvalid},
 	},
 }
 
+func makeSample(c map[string]interface{}) string {
+	file, _ := os.Open("test/sample_key")
+	buf := new(bytes.Buffer)
+	io.Copy(buf, file)
+	key := buf.Bytes()
+	file.Close()
+
+	token := New(GetSigningMethod("RS256"))
+	token.Claims = c
+	s, e := token.SignedString(key)
+
+	if e != nil {
+		panic(e.Error())
+	}
+
+	return s
+}
+
 func TestJWT(t *testing.T) {
 	file, _ := os.Open("test/sample_key.pub")
 	buf := new(bytes.Buffer)
@@ -38,17 +81,33 @@ func TestJWT(t *testing.T) {
 	file.Close()
 
 	for _, data := range jwtTestData {
+		if data.tokenString == "" {
+			data.tokenString = makeSample(data.claims)
+		}
+
 		token, err := Parse(data.tokenString, func(t *Token) ([]byte, error) { return key, nil })
 
 		if !reflect.DeepEqual(data.claims, token.Claims) {
 			t.Errorf("[%v] Claims mismatch. Expecting: %v  Got: %v", data.name, data.claims, token.Claims)
 		}
 		if data.valid && err != nil {
-			t.Errorf("[%v] Error while verifying token: %v", data.name, err)
+			t.Errorf("[%v] Error while verifying token: %T:%v", data.name, err, err)
 		}
 		if !data.valid && err == nil {
 			t.Errorf("[%v] Invalid token passed validation", data.name)
 		}
+		if data.validationError != nil {
+			if err == nil {
+				t.Errorf("[%v] Expecting error.  Didn't get one.", data.name)
+			} else {
+				// perform deep equal without the string bit
+				err.(*ValidationError).err = ""
+				if !reflect.DeepEqual(data.validationError, err) {
+					t.Errorf("[%v] Errors don't match expectation", data.name)
+				}
+
+			}
+		}
 	}
 }
 
@@ -61,6 +120,10 @@ func TestParseRequest(t *testing.T) {
 
 	// Bearer token request
 	for _, data := range jwtTestData {
+		if data.tokenString == "" {
+			data.tokenString = makeSample(data.claims)
+		}
+
 		r, _ := http.NewRequest("GET", "/", nil)
 		r.Header.Set("Authorization", fmt.Sprintf("Bearer %v", data.tokenString))
 		token, err := ParseFromRequest(r, func(t *Token) ([]byte, error) { return key, nil })