OPEnSLab-OSU / Spool

GNU General Public License v3.0
2 stars 1 forks source link

JWT verification request not successful on API #3

Closed eliwinkelman closed 4 years ago

eliwinkelman commented 4 years ago

The JWT verification request sent by the Spool API to Auth0 isn't successful. It appears that the request is being rerouted from opens.auth0.com to the spool API server. The request fails to receive a response and the api registers a 404 not found at the endpoint that was supposed to be queried on the auth0 server.

Reproducibility This bug only occurs in the production version of the code running on the production server in the docker container. This makes it difficult (impossible?) to reproduce without using the production server.

Relevant Areas of Code

The request is sent by the getKeys() function in the auth0/node-jwks-rsa library.

getKeys(cb) {
    this.logger(`Fetching keys from '${this.options.jwksUri}'`);
    request({
      json: true,
      uri: this.options.jwksUri,
      strictSSL: this.options.strictSsl,
      headers: this.options.requestHeaders,
      agentOptions: this.options.requestAgentOptions
    }, (err, res) => {
      if (err || res.statusCode < 200 || res.statusCode >= 300) {
        this.logger('Failure:', res && res.body || err);
        if (res) {
          return cb(new JwksError(res.body && (res.body.message || res.body) || res.statusMessage || `Http Error ${res.statusCode}`));
        }
        return cb(err);
      }

      this.logger('Keys:', res.body.keys);
      return cb(null, res.body.keys);
    });
  }

This is the where the request is being sent in spool (api/lib/middleware/secured.js):

const checkJwt = jwt({
    secret: jwksRsa.expressJwtSecret({
        strictSsl: false,
        cache: true,
        rateLimit: true,
        jwksRequestsPerMinute: 5,
        jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`,
        requestAgentOptions: {
            rejectUnauthorized: false
        }
    }),
    audience: 'localhost:4000',
    issuer: `https://${process.env.AUTH0_DOMAIN}/`,
    algorithm: ["RS256"]
});
prototypicalpro commented 4 years ago

Problem was caused by mixing iptables config on host and in container. All iptables configurations have been moved to docker files to prevent conflict.