gRPC: JWT interceptor on gRPC

We will use rk-boot to enable JWT interceptor on gRPC server.

rk-boot will automatically start grpc-gateway on gRPC service with same port.

Install rk-boot

go get github.com/rookie-ninja/rk-boot
go get github.com/rookie-ninja/rk-grpc

Quick start

Please visit rkdev.info for detailed document.

I. Create boot.yaml

boot.yaml is used to tell rk-boot how to start gRPC service.

• Enabled commonService contains couple of utility APIs. Details
• Enabled RK style grpc-gateway option via enableRkGwOption which can normalize gRPC error to Restful API error.
• Enabled JWT interceptor with [my-secret] as signing key and HS256 as signing algorithm by default.

II. Create main.go

III. Create JWT Token

There are multiple lib can be used to encode/decode JWT token which can be found at official site.

Get mofcloud’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

For convenience, we create a demo token from official site with [my-secret] as signing key and HS256 as signing algorithm which matches configurations in boot.yaml.

IV. Validate

• Send request to /rk/v1/healthy with VALID JWT token.

$ curl localhost:8080/rk/v1/healthy -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.EpM5XBzTJZ4J8AfoJEcJrjth8pfH28LWdjLo90sYb9g"
{"healthy":true}

• Send request to /rk/v1/healthy with INVALID JWT token.

$ curl localhost:8080/rk/v1/healthy -H "Authorization: Bearer invalid-jwt-token"
{
    "error":{
        "code":401,
        "status":"Unauthorized",
        "message":"invalid or expired jwt",
        "details":[
            {
                "code":16,
                "status":"Unauthenticated",
                "message":"[from-grpc] invalid or expired jwt"
            },
            {
                "code":2,
                "status":"Unknown",
                "message":"token contains an invalid number of segments"
            }
        ]
    }
}

JWT interceptor options

• The supported scheme of tokenLookup for gRPC is header based only currently.

// Optional. Default value "header:Authorization".
// Possible values:
// - "header:<name>"
// Multiply sources example:
// - "header: Authorization,cookie: myowncookie"

• Supported signing algorithms

Since rk-boot use github.com/golang-jwt/jwt as dependency, the supported signing algorithms are based on golang-jwt.

HS256，HS384，HS512，RS256，RS384，RS512，ES256，ES384，ES512，EdDSA

• singingKeys

Please refer RFC7515 for details.

Use [:] to separate key value pairs as bellow:

signingKeys:
  - "key:value"

Example of gRPC protocol

In this example, we will try to send request with gRPC protocol to validate JWT interceptor.

We will use grpcurl to call rk.api.v1.RkCommonService.Healthy method defined in CommonService.

In order to use grpcurl, we need to enable gRPC reflection in boot.yaml via enableReflection

Nothing else needs to be changed in this example.

• Send request to rk.api.v1.RkCommonService.Healthy with VALID JWT token.

$ grpcurl -plaintext -H "Authorization:Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.EpM5XBzTJZ4J8AfoJEcJrjth8pfH28LWdjLo90sYb9g" localhost:8080 
rk.api.v1.RkCommonService.Healthy
{
    "healthy": true
}

• Send request to rk.api.v1.RkCommonService.Healthy with INVALID JWT token.

$ grpcurl -plaintext -H "Authorization:Bearer invalid-jwt-token" localhost:8080 rk.api.v1.RkCommonService.Healthy
Error invoking method "rk.api.v1.RkCommonService.Healthy": rpc error: code = Unauthenticated desc = failed to query for service descriptor "rk.api.v1.RkCommonService": invalid or expired jwt