From 0a2d80518fe59aec1177051d4eeb418bfb745bbb Mon Sep 17 00:00:00 2001 From: Daniel Lehrner Date: Tue, 26 Jul 2022 17:11:24 +0200 Subject: [PATCH] Change expiration for JWT authentification of engine port to 60 seconds (#4168) * change expiration for JWT authentification of engine port to 60 seconds Signed-off-by: Daniel Lehrner --- CHANGELOG.md | 1 + .../api/jsonrpc/authentication/EngineAuthService.java | 4 +++- .../jsonrpc/authentication/EngineAuthServiceTest.java | 11 +++-------- 3 files changed, 7 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4961450c427..24de4623e56 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ## 22.7.0 ### Additions and Improvements +- Engine API: Change expiration time for JWT tokens to 60s [#4168](https://github.com/hyperledger/besu/pull/4168) ### Bug Fixes diff --git a/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/authentication/EngineAuthService.java b/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/authentication/EngineAuthService.java index 12a5f67ac49..e6120ac29e1 100644 --- a/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/authentication/EngineAuthService.java +++ b/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/authentication/EngineAuthService.java @@ -44,6 +44,8 @@ public class EngineAuthService implements AuthenticationService { private static final Logger LOG = LoggerFactory.getLogger(EngineAuthService.class); + private static final int JWT_EXPIRATION_TIME = 60; + private final JWTAuth jwtAuthProvider; public EngineAuthService(final Vertx vertx, final Optional signingKey, final Path datadir) { @@ -167,6 +169,6 @@ public boolean isPermitted( private boolean issuedRecently(final long iat) { long iatSecondsSinceEpoch = iat; long nowSecondsSinceEpoch = System.currentTimeMillis() / 1000; - return (Math.abs((nowSecondsSinceEpoch - iatSecondsSinceEpoch)) <= 5); + return (Math.abs((nowSecondsSinceEpoch - iatSecondsSinceEpoch)) <= JWT_EXPIRATION_TIME); } } diff --git a/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/authentication/EngineAuthServiceTest.java b/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/authentication/EngineAuthServiceTest.java index 9cf3e00c890..d8fb363385a 100644 --- a/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/authentication/EngineAuthServiceTest.java +++ b/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/authentication/EngineAuthServiceTest.java @@ -110,15 +110,10 @@ public void denyExpired() throws IOException, URISyntaxException { assertThat(auth).isNotNull(); JWTAuth jwtAuth = auth.getJwtAuthProvider(); String token = - jwtAuth.generateToken(new JsonObject().put("iat", (System.currentTimeMillis() / 1000) - 6)); + jwtAuth.generateToken( + new JsonObject().put("iat", (System.currentTimeMillis() / 1000) - 61)); - Handler> authHandler = - new Handler>() { - @Override - public void handle(final Optional event) { - assertThat(event).isEmpty(); - } - }; + Handler> authHandler = event -> assertThat(event).isEmpty(); auth.authenticate(token, authHandler); } }