add simplejwt source code

2020-11-05 17:08:28 +08:00
parent ae537004e4
commit 93b323ee0c
9 changed files with 12333 additions and 0 deletions
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICwDCCAmagAwIBAgIUHo/UysuMf4+WAcChW3hM1NHDQDkwCgYIKoZIzj0EAwIw
+gbYxCzAJBgNVBAYTAkNOMQ4wDAYDVQQIDAVBbmh1aTEOMAwGA1UEBwwFSGVmZWkx
+HjAcBgNVBAoMFVVTVEMgTGludXggVXNlciBHcm91cDEhMB8GA1UECwwYVGhlIEhh
+Y2tlcmdhbWUgQ29tbWl0dGVlMR0wGwYDVQQDDBRoYWNrLmx1Zy51c3RjLmVkdS5j
+bjElMCMGCSqGSIb3DQEJARYWaGFja2VyZ2FtZUB1c3RjbHVnLm9yZzAeFw0yMDEw
+MDgxNTIwMzZaFw0yMTEwMDgxNTIwMzZaMIG2MQswCQYDVQQGEwJDTjEOMAwGA1UE
+CAwFQW5odWkxDjAMBgNVBAcMBUhlZmVpMR4wHAYDVQQKDBVVU1RDIExpbnV4IFVz
+ZXIgR3JvdXAxITAfBgNVBAsMGFRoZSBIYWNrZXJnYW1lIENvbW1pdHRlZTEdMBsG
+A1UEAwwUaGFjay5sdWcudXN0Yy5lZHUuY24xJTAjBgkqhkiG9w0BCQEWFmhhY2tl
+cmdhbWVAdXN0Y2x1Zy5vcmcwVjAQBgcqhkjOPQIBBgUrgQQACgNCAAQcAwLQKJf1
+W8podrvryfX7GI3xEneVlEriKNh7ltLe35BfU405TSKVXOKZfxdukiUwKZUPOI4o
+zqsAfklnl/Jco1MwUTAdBgNVHQ4EFgQUnHTMWSWk9BgfVDphGi/VhTH5zOYwHwYD
+VR0jBBgwFoAUnHTMWSWk9BgfVDphGi/VhTH5zOYwDwYDVR0TAQH/BAUwAwEB/zAK
+BggqhkjOPQQDAgNIADBFAiAtkdkJ6vO1abjJt5jCnRDHCnGHTPetOtAQ12Fr1fo1
+eQIhAO4T9HjFgSAP5Bg/bzeTS5jGvZAnN14e2sjllR6392J8
+-----END CERTIFICATE-----
@@ -0,0 +1,97 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <title>普通的身份认证器</title>
+        <meta charset="UTF-8">
+        <link rel="stylesheet" href="static/user.css">
+    </head>
+    <body>
+        <noscript>
+            Although not necessary...
+            It's recommended to enable JavaScript to solve this problem.
+        </noscript>
+        <div id="app">
+            <input v-model.trim="token" placeholder="在这里输入比赛 token...">
+            <button @click='login'>以 Guest 登录</button>
+            <button @click='getProfile'>获取用户信息</button>
+            <div class="text-block">
+                <p>{{ message }}</p>
+            </div>
+        </div>
+        <!-- Powered by FastAPI, Axios and Vue.js -->
+        <script src="static/axios.min.js"></script>
+        <script src="static/vue.js"></script>
+
+        <script>
+            var app = new Vue({
+                el: '#app',
+                data: {
+                    message: '请点击登录...',
+                    jwt: null,
+                    token: null,
+                },
+                methods: {
+                    login: function () {
+                        if (this.token) {
+                            axios.post('/token', null, {
+                                headers: {
+                                    "Hg-Token": this.token
+                                }
+                            }).then(
+                                response => {
+                                    this.jwt = response.data.access_token
+                                    this.message = '登录成功。'
+                                }
+                            ).catch(
+                                error => {
+                                    this.message = this.errorOutput(error);
+                                }
+                            )
+                        } else {
+                            this.message = '请输入你的比赛 token。';
+                        }
+                    },
+                    getProfile: function () {
+                        if (!this.jwt) {
+                            this.message = '请先登录。';
+                        }
+                        else if (this.token) {
+                            axios.get('/profile', {
+                                headers: {
+                                    Authorization: 'Bearer ' + this.jwt,
+                                    "Hg-Token": this.token
+                                }
+                            }).then(
+                                response => {
+                                    this.message = response.data;
+                                }
+                            ).catch(
+                                error => {
+                                    this.message = this.errorOutput(error);
+                                }
+                            );
+                        } else {
+                            this.message = '请输入你的比赛 token。';
+                        }
+                    },
+                    errorOutput: function (error) {
+                        if (error.response) {
+                            return error.response.data.detail + "(" + error.response.status + ")";
+                        } else if (error.request) {
+                            return "未能连接到后端服务器。";
+                        } else {
+                            return "未知错误: " + error.message;
+                        }
+                    }
+                },
+                mounted: function () {
+                    const token = new URLSearchParams(window.location.search).get("token");
+                    window.history.replaceState({}, null, '/');
+                    if (token) {
+                        this.token = token;
+                    }
+                }
+            });
+        </script>
+    </body>
+</html>
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKwIBAAKCAgEAn/KiHQ+/zwE7kY/Xf89PY6SowSb7CUk2b+lSVqC9u+R4BaE/
+5tNFeNlneGNny6fQhCRA+Pdw1UJSnNpG26z/uOK8+H7fMb2Da5t/94wavw410sCK
+Vbvfft8gKquUaeq//tp20BETeS5MWIXp5EXCE+lEdAHgmWWoMVMIOXwaKTMnCVGJ
+2SRr+xH9147FZqOa/17PYIIHuUDlfeGi+Iu7T6a+QZ0tvmHL6j9Onk/EEONuUDfE
+lonYM688jhuAM/FSLfMzdyk23mJk3CKPah48nzVmb1YRyfBWiVFGYQqMCBnWgoGO
+anpd46Fp1ff1zBn4sZTfPSOus/+00D5Lxh6bsbRa6A1vAApfmTcu026lIb7gbG7D
+U1/seDId9s1qA5BJpzWFKO4ztkPGvPTUok8hQBMDaSH1JOoFQgfJIfC7w2CQe+Kb
+odQL3akKQDCZhcoA4tf5VC6ODJpFxCn6blML5cD6veOBPJiIk8DBRgmt2AHzOUju
+5nsQcplOVxW5TFYxLqeJ8FPWqQcVekZ749FjchtAwPlUsoWIH0PTSun38ua8usr
+wTXbpBlf4r0wz22FPqaecvp7z6Rj/xfDauDGDSU4hmn/TY9Fr+OmFJPW/9k2RAv7
+KEFvFCLP/3U3r0FMwSe/FPHmt5fjAtsGlZLj+bZsgwFllYeD90VQU8Ds+KkCAwEA
+AQKCAgEAm7GhYEyeVzBJ/e1Yxg7Uppf3tNzu7CEaHmGuRqj9R9KjikdmXpg1PefS
+MnwA41sdPCPWIwMqEE0ZAZnv85I48o2ziOhm9pIVRT/+lscImgWJGvdVMRNKAMPN
+Gfwe4eMitT+O/AZDQGhy5JCmFhBZVOxyN8JEEM3FpQ3AKcTF6mjijM2UM4yil6jx
+wUw2lyyWihKOJtEsF4Y2XgyviOTrliMne9M2XeXwirrJGo1mu1HHZcqDUE4p6FWh
+ymq2ptk3N4dPB6VUxbBdoXL6yz9Xn1ppteLAOiP6+Hvm2DteB9yu1CasrLUkg5nx
+3dgaqWx2itXxYCBFxO0Z4sNhGx9cSVq3mq1ip0AKzH7sAeCKjXFJtA8HxcnHcECn
+jRs91X9eXu4DHMga2o+JkyBde1IHWTVX3XPdeuMfQk67s1AOFEZRNXop0CrGif+9
+/FHxn16F7MGoIer2itBo5qVZg3kvYyaPB4ro25kS9y2nNQ3BPO4UdGBPdwWJ3S9N
+xDMmwcZKYkwe802ft5hnJ1PKLrYDYy3DkK+AOqV/0fO2p1JylLammtVtlbLkKgsO
+cwe8nAKNnpS8IowB2y29cvQHme5et303p7aWoqYZE8Epc5hTHcTM70hrFtPYU1Ae
+1PlNa7PCY33By9BTYPKGUlcw9upfE7oCS2DybgPnvbyNpBDs0kkCggEBANCOTgpH
+dgX1LrzsqBJBbVTM5fytUQ3sXgvzzbmOLtjWa8rL+5HGAkqACT8aV+faKSKt8YIu
+TUdAOkoGjBvikT0nbV7OS4srxgRa+qzVT4nhOn+4q1WSk1eArP98lHrYPXwNgGNv
+g7XWiW1IClvHGjq8AWYCX7ky2jps0JsvxMTZcTkMit9WKVLKTdzUeU047S6l0QS8
+aKjO0HQVYCBcmzmOMyFwtgaxbYsLc/eux09ttTAhoLaud4brDb5IBbjmssHvoJak
+FTwuMZgKN6BSZWGY6NOvxJpHausFPuSoJorw2ZwTqjsgzfegNN5N8FPUKSISdBBB
+F7cjfYU8467W1NMCggEBAMRViGRC/jJIewUadl494Qnj3MTAsv6pys4phwI8/RsV
+VjCFFAz7deyotfciw6Co4y96D9fZd57P9Kflz3tjC9Zjdqkb6Jv64zONdV1xfg6Z
+XT2cfB1/PBN5jA+tOWGZwKjzs1wgwKehj/IYNsmnS1tLdzUJhUf0/ESzRMVg7Mwm
+C2JLjsFDmGKKdk+iVbqAKZbKHWoJQpVzXFEDgz5AG3ccHNjwGyExRafbps6gcU62
+w9NFeFW207Tgk9vTzMLnpwCw2kaEggn2I3lb+XOt/gMRmBkzb2g0JQGwdIcEMYn9
+6K9Gadi/65OhmCLEOfGQefwDbAVFqIrLOoeVp4jv/xMCggEBAIq3zJKru4X08hR5
+eMVDvXvlGah6g2o2aMuca57bQq+511K5YOgyAz4YcY4GcKfnhOrrNbM4JvCYeOzZ
+9AFsLty1R9sCbl7wS7KD7S5eZ5w3MhjX9SZi6xwNm4QIEh6vjB3iQR5igwHE4/3L
+KBCpmvmsKWX3eEIP3/VygUJngILKerPOcuRgQ/YsV6Pls5U4oxIe+qsiwp5diWtc
+GYuEpUyzzGT7Y8AHvOYN5dsKmfbeeO8ylAYNaqI18hT0XKOCCJUx8TK+NDhjN0r
+FprNk19aPKrow2U20ZfnElE2wwQxdRyKO/U+OaFWbzPaNVscyAtAqPBSy3pl4cxo
+lqypej8CggEBAIRb/WVKXMBdaMIaAu6p3MqkGTNzjbhtk1HFYUU7BI97pO106f2O
+kQOJAZOoliX7dZ2ONpwX+bLRE2kVXvkZ3uMbjuWW8Qwm6YDZvuPOHWOONPPSSUJB
+gqjGaowvBd4sn1vHX4WedwMLwlU9ycHMzNqxV54j2vyVxnQyPwypuTov88DCm2zj
+OxpDqlspX44p1N/ZRlc0AvVqHjRnn9UZtupnw3Lk/AU2iHUPebcXJwwf3ojR7rwq
+UzM/q66pbQOA1G98ysp7jodUrrmkLdm01OgQtm9W46ZmcQRgh052n0ceK/3uBHGh
+gRm3+S6HB2E5O2OQkwRC38siE0VQuO9yjI0CggEBAJtaBrK7KAS3CtDnFNN5O1uU
+DdNpRhpODQsaz1CmZ6Fh+HdZ79m92rY57fXB+hAuVAhAFtCsfcf+C/z3uGhGoTCp
+u664ZqaYKasEXk8id8o4SIkv34/jh53kXpQCRoUdUcqaRmymOPCBZgvpr+kmwtm0
+6P3MRNJ8chQgLAWhd3IiYFwOy2P2kZS550E3YMYsccAj7uBrrY+/hFxbRffOYB/o
+ZQiLZ9ypFuO3jMY4iVma5fpPwJh0JrTms/hmj722cu8pE4RWTJlzvFb2gqRO9Oz0
+kwaO7Tjym8KVz38Micz/QOOsq62I4SfjNOzDS/Ur0d9MpWl3H6Mmmde/4UusdJY=
+-----END RSA PRIVATE KEY-----
@@ -0,0 +1,13 @@
+-----BEGIN RSA PUBLIC KEY-----
+MIICCgKCAgEAn/KiHQ+/zwE7kY/Xf89PY6SowSb7CUk2b+lSVqC9u+R4BaE/5tNF
+eNlneGNny6fQhCRA+Pdw1UJSnNpG26z/uOK8+H7fMb2Da5t/94wavw410sCKVbvf
+ft8gKquUaeq//tp20BETeS5MWIXp5EXCE+lEdAHgmWWoMVMIOXwaKTMnCVGJ2SRr
+xH9147FZqOa/17PYIIHuUDlfeGi+Iu7T6a+QZ0tvmHL6j9Onk/EEONuUDfElonY
+M688jhuAM/FSLfMzdyk23mJk3CKPah48nzVmb1YRyfBWiVFGYQqMCBnWgoGOanpd
+46Fp1ff1zBn4sZTfPSOus/+00D5Lxh6bsbRa6A1vAApfmTcu026lIb7gbG7DU1/s
+eDId9s1qA5BJpzWFKO4ztkPGvPTUok8hQBMDaSH1JOoFQgfJIfC7w2CQe+KbodQL
+3akKQDCZhcoA4tf5VC6ODJpFxCn6blML5cD6veOBPJiIk8DBRgmt2AHzOUju+5ns
+QcplOVxW5TFYxLqeJ8FPWqQcVekZ749FjchtAwPlUsoWIH0PTSun38ua8usrwTXb
+pBlf4r0wz22FPqaecvp7z6Rj/xfDauDGDSU4hmn/TY9Fr+OmFJPW/9k2RAv7KEFv
+FCLP/3U3r0FMwSe/FPHmt5fjAtsGlZLj+bZsgwFllYeD90VQU8Ds+KkCAwEAAQ==
+-----END RSA PUBLIC KEY-----
@@ -0,0 +1,178 @@
+from datetime import datetime, timedelta
+from typing import Optional
+
+from fastapi import Depends, FastAPI, HTTPException, status, Header, Request
+from fastapi.security import OAuth2PasswordBearer
+from fastapi.responses import FileResponse
+from fastapi.staticfiles import StaticFiles
+import jwt
+from pydantic import BaseModel
+from hashlib import sha256
+import logging
+from fastapi.logger import logger as fastapi_logger
+
+import OpenSSL
+import base64
+
+
+ACCESS_TOKEN_EXPIRE_MINUTES = 30
+PUBLIC_KEY = open("jwt.key.pub", "r").read()
+PRIVATE_KEY = open("jwt.key", "r").read()
+SALT = b'd_Yn2xWvnu'
+
+
+users_db = {
+    "admin": {
+        "username": "admin",
+        "flag": "flag{just_A_simple_Json_Web_T0ken_exp1oit_",
+        "disabled": False,
+    },
+    "guest": {
+        "username": "guest",
+        "flag": "只有 'admin' 用户才有 flag 哦！",
+        "disabled": False,
+    }
+}
+
+
+with open("cert.pem") as f:
+    cert = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, f.read())
+
+
+class Token(BaseModel):
+    access_token: str
+    token_type: str
+
+
+class TokenData(BaseModel):
+    username: Optional[str] = None
+
+
+class User(BaseModel):
+    username: str
+    disabled: Optional[bool] = None
+
+
+class UserInDB(User):
+    flag: str
+
+
+class TokenOption(BaseModel):
+    hg_token: str
+
+
+oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
+
+app = FastAPI()
+
+logger = logging.getLogger(__name__)
+
+app.mount("/static", StaticFiles(directory="static"), name="static")
+
+
+def get_user(db, username: str):
+    if username in db:
+        user_dict = db[username]
+        return UserInDB(**user_dict)
+
+
+def authenticate_user(db, username: str, password: str):
+    user = get_user(db, username)
+    if not user:
+        return False
+    if username != "guest":
+        return False
+    return user
+
+
+def create_access_token(data: dict, expires_delta: Optional[timedelta] = None):
+    to_encode = data.copy()
+    if expires_delta:
+        expire = datetime.utcnow() + expires_delta
+    else:
+        expire = datetime.utcnow() + timedelta(minutes=15)
+    to_encode.update({"exp": expire})
+    encoded_jwt = jwt.encode(to_encode, PRIVATE_KEY, algorithm="RS256")
+    return encoded_jwt
+
+
+def check_hackergame_token(hg_token):
+    raise_error = False
+    if hg_token is None:
+        raise_error = True
+    else:
+        try:
+            id, sig = hg_token.split(":", 1)
+            sig = base64.b64decode(sig, validate=True)
+            OpenSSL.crypto.verify(cert, sig, id.encode(), "sha256")
+        except Exception as e:
+            raise_error = True
+    if raise_error:
+        raise HTTPException(status_code=403, detail="比赛 token 校验错误。\n如果您正在使用网页完成此题目，请从比赛平台打开题目（推荐），或正确输入比赛 token。\n如果您正在使用非网页方式请求后端，请确认 HTTP 请求头 hg-token 设置正确。")
+    return True
+
+
+async def get_current_user(token: str = Depends(oauth2_scheme)):
+    credentials_exception = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Could not validate credentials",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+    try:
+        payload = jwt.decode(token, PUBLIC_KEY)
+        username: str = payload.get("sub")
+        if username is None:
+            raise credentials_exception
+        token_data = TokenData(username=username)
+    except:
+        raise credentials_exception
+    user = get_user(users_db, username=token_data.username)
+    if user is None:
+        raise credentials_exception
+    return user
+
+
+async def get_current_active_user(current_user: User = Depends(get_current_user)):
+    if current_user.disabled:
+        raise HTTPException(status_code=400, detail="Inactive user")
+    return current_user
+
+
+@app.post("/token", response_model=Token)
+async def login_for_access_token(hg_token: Optional[str] = Header(None)):
+    check_hackergame_token(hg_token)
+    access_token_expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
+    access_token = create_access_token(
+        data={"sub": "guest"}, expires_delta=access_token_expires
+    )
+    return {"access_token": access_token, "token_type": "bearer"}
+
+
+@app.get("/profile", response_model=UserInDB)
+async def read_users_me(raw: Request,
+                        current_user: User = Depends(get_current_active_user), 
+                        hg_token: Optional[str] = Header(None)):
+    check_hackergame_token(hg_token)
+    if current_user.username == 'admin':
+        # format flag
+        user = current_user.copy()
+        user.flag = user.flag + \
+            sha256(SALT + hg_token.encode('utf-8')).hexdigest()[:6] + '}'
+        # log user data for future analysis
+        fastapi_logger.warn(f"User with token {hg_token[:10]} gets flag with jwt {raw.headers['authorization']}")
+    else:
+        user = current_user
+    return user
+
+
+@app.get("/")
+def index():
+    return FileResponse('index.html', media_type='text/html')
+
+
+@app.post("/debug")
+async def debug():
+    return {
+        "ACCESS_TOKEN_EXPIRE_MINUTES": ACCESS_TOKEN_EXPIRE_MINUTES,
+        "PUBLIC_KEY": PUBLIC_KEY
+    }
@@ -0,0 +1,6 @@
+fastapi==0.61.0
+uvicorn==0.11.8
+PyJWT==1.5.0  # intentionally here!
+cryptography==3.1.1
+aiofiles==0.5.0
+pyOpenSSL==19.1.0  # dynamic flag check
@@ -0,0 +1,3 @@
+.text-block {
+    white-space: pre;
+}