laravel passport加密jwt格式的access_token中的sub(user_id)字段

2022-05-19 02:41:22

在很多需求我们不希望别人知道用户在我们表中的 user_id ；
但是又想用数据库的自增 id 功能；
一般时候在取出用户后加密 user_id 加密即可；
但是总有那么几个不经意间就可能把我们的 user_id 暴露了；
比如说 laravel 的 passport ；

创建一个项目用于测试;

laravel new passport

Bash

Copy

安装 passport；

composer require laravel/passport

php artisan migrate

php artisan passport:install

Bash

Copy

现在我们有了用于测试的 Clint；

laravel passport加密jwt格式的access_token中的sub(user_id)字段

将 Laravel\Passport\HasApiTokens Trait 添加到 App\User 模型中；

<?php

namespace App;

+ use Laravel\Passport\HasApiTokens;

use Illuminate\Notifications\Notifiable;

use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable

{

+    use HasApiTokens, Notifiable;

    // ...

}

Diff

Copy

在 AuthServiceProvider 的 boot 方法中增加 Passport::routes() ;

<?php

namespace App\Providers;

+ use Laravel\Passport\Passport;

use Illuminate\Support\Facades\Gate;

use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;

class AuthServiceProvider extends ServiceProvider

{

    /**

     * The policy mappings for the application.

     *

     * @var array

     */

    protected $policies = [

        'App\Model' => 'App\Policies\ModelPolicy',

    ];

    /**

     * 注册任何认证/授权服务。

     *

     * @return void

     */

    public function boot()

    {

        $this->registerPolicies();

+        Passport::routes();

    }

}

Diff

Copy

将 config/auth.php 中的 driver 改为 passport;

'guards' => [

    'web' => [

        'driver' => 'session',

        'provider' => 'users',

    ],

    'api' => [

-        'driver' => token',

+       'driver' => 'passport',

         'provider' => 'users',

    ],

],

Diff

Copy

创建测试用户

php artisan make:seeder UsersTableSeeder

Bash

Copy

<?php

use Illuminate\Database\Seeder;

class UsersTableSeeder extends Seeder

{

    /**

     * Run the database seeds.

     *

     * @return void

     */

    public function run()

    {

        factory(App\User::class, 5)->create();

    }

}

PHP

Copy

php artisan db:seed --class=UsersTableSeeder

Bash

Copy

测试用户也有了；

获取下 access_token ；

我们拿着 access_token 去 jwt.io 解开看下；

可以看到 PAYLOAD 中的 sub 就是我们的未加密的用户id；
下面就是将 user_id 加密的过程了；

既然是加密id；
那还需要安装一个扩展包；
示例中我们使用laravel-hashids

composer require vinkla/hashids

php artisan vendor:publish --provider='Vinkla\Hashids\HashidsServiceProvider'

Bash

Copy

随便配置下；
/config/hashids.php

'main' => [

-            'salt' => 'your-salt-string',

-            'length' => 'your-length-integer',

+            'salt' => 'alsd2987vnvczx&^$%Tpweqfhkjn',

+            'length' => 20,

        ],

Diff

Copy

加密用户id；
这里主要用到了 laravel 留的一个钩子；
vendor/laravel/passport/src/Bridge/UserRepository.php

在 getUserEntityByUserCredentials 中会判断 User 模型是否有 findForPassport 方法；
我们可以在此处加密；
app/User.php

<?php

namespace App;

use Illuminate\Notifications\Notifiable;

use Illuminate\Contracts\Auth\MustVerifyEmail;

use Illuminate\Foundation\Auth\User as Authenticatable;

use Laravel\Passport\HasApiTokens;

use Hashids;

class User extends Authenticatable

{

    use HasApiTokens, Notifiable;

    /**

     * The attributes that are mass assignable.

     *

     * @var array

     */

    protected $fillable = [

        'name', 'email', 'password',

    ];

    /**

     * The attributes that should be hidden for arrays.

     *

     * @var array

     */

    protected $hidden = [

        'password', 'remember_token',

    ];

    /**

     * 此处定义 getIdAttribute 是为了跳过模型把主键 id 转成数字的操作

     *

     * @see \Illuminate\Database\Eloquent\Concerns\HasAttributes::getAttributeValue()

     *

     * @param $value

     * @return mixed

     */

    public function getIdAttribute($value)

    {

        return $value;

    }

    /**

     * 当获取用户的时候加密 user_id

     *

     * 下面这些方法是为了加密和解密 jwt 中的 user_id

     * @see \App\Extensions\Illuminate\Auth\ExtendedUserProvider::retrieveById()

     * @see \App\Models\User::findForPassport()

     * @see \App\Models\OauthAccessToken::setUserIdAttribute()

     *

     * @param string $email

     *

     * @return User

     */

    public function findForPassport($email): self

    {

        $user     = $this->where('email', $email)->first();

        $user->id = Hashids::encode($user->id);

        return $user;

    }

}

PHP

Copy

因为上面把 user_id 加密了；
而 oauth_access_tokens 表中的 user_id 是 int 类型；
所以我们需要在向 oauth_access_tokens 存储数据的时候自动解密 user_id ；

php artisan make:model OauthAccessToken

Bash

Copy

<?php

namespace App;

use Laravel\Passport\Token;

use Vinkla\Hashids\Facades\Hashids;

class OauthAccessToken extends Token

{

    /**

     * 当向 oauth_access_tokens 表中存储数据的时候解密 user_id

     *

     * 下面这些方法是为了加密和解密 jwt 中的 user_id

     * @see \App\Extensions\Illuminate\Auth\ExtendedUserProvider::retrieveById()

     * @see \App\Models\User::findForPassport()

     * @see \App\Models\OauthAccessToken::setUserIdAttribute()

     *

     * @param int|string $value

     */

    public function setUserIdAttribute($value): void

    {

        if (is_numeric($value)) {

            $this->attributes['user_id'] = $value;

        } else {

            $this->attributes['user_id'] = current(Hashids::decode($value));

        }

    }

}

PHP

Copy

覆盖 passport 的 OauthAccessToken ；
app/Providers/AuthServiceProvider.php

<?php

namespace App\Providers;

use App\OauthAccessToken;

use Illuminate\Support\Facades\Gate;

use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;

use Laravel\Passport\Passport;

class AuthServiceProvider extends ServiceProvider

{

    /**

     * The policy mappings for the application.

     *

     * @var array

     */

    protected $policies = [

        'App\Model' => 'App\Policies\ModelPolicy',

    ];

    /**

     * Register any authentication / authorization services.

     *

     * @return void

     */

    public function boot()

    {

        $this->registerPolicies();

        Passport::routes();

+        Passport::useTokenModel(OauthAccessToken::class);

    }

}

Diff

Copy

再获取下 access_token ；

如我们所愿；
user_id 已经被加密了；
接着还需要处理的是当我们拿着这个token去访问应用的时候能成功验证；
并且可以正确的获取到用户；
定义ExtendedUserProvider 用于覆盖 retrieveById 方法；
app/Extensions/Illuminate/Auth/ExtendedUserProvider.php

<?php

namespace App\Extensions\Illuminate\Auth;

use App\User;

use Illuminate\Auth\AuthenticationException;

use Illuminate\Auth\EloquentUserProvider;

use Vinkla\Hashids\Facades\Hashids;

class ExtendedUserProvider extends EloquentUserProvider

{

    /**

     * 当获取用户的时候解密 user_id

     *

     * 下面这些方法是为了加密和解密 jwt 中的 user_id

     * @see \App\Extensions\Illuminate\Auth\ExtendedUserProvider::retrieveById()

     * @see \App\User::findForPassport()

     * @see \App\OauthAccessToken::setUserIdAttribute()

     *

     * @param int|string $identifier

     * @return User

     * @throws AuthenticationException

     */

    public function retrieveById($identifier)

    {

        $model = $this->createModel();

        /**

         * If Id is a string, then we need to decrypt $identifier.

         *

         * @see \App\Models\User::findForPassport()

         */

        if (!is_numeric($identifier)) {

            $identifier = current(Hashids::decode($identifier));

        }

        return $model->newQuery()

            ->where($model->getAuthIdentifierName(), $identifier)

            ->first();

    }

}

PHP

Copy

修改配置项把 auth.providers.users.driver 改成
config/auth.php

'providers' => [

        'users' => [

-            'driver' => 'extended',

+            'model' => App\User::class,

        ]

    ],

Diff

Copy

app/Providers/AuthServiceProvider.php

<?php

namespace App\Providers;

use App\Extensions\Illuminate\Auth\ExtendedUserProvider;

use App\OauthAccessToken;

use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;

use Laravel\Passport\Passport;

use Illuminate\Foundation\Application;

use Auth;

class AuthServiceProvider extends ServiceProvider

{

    /**

     * The policy mappings for the application.

     *

     * @var array

     */

    protected $policies = [

        'App\Model' => 'App\Policies\ModelPolicy',

    ];

    /**

     * Register any authentication / authorization services.

     *

     * @return void

     */

    public function boot()

    {

        $this->registerPolicies();

        Passport::routes();

        Passport::useTokenModel(OauthAccessToken::class);

        /**

         * Register @see \App\Extensions\Illuminate\Auth\ExtendedUserProvider

         */

        Auth::provider('extended', function ($app, $config) {

            $model = $config['model'];

            return new ExtendedUserProvider($app['hash'], $model);

        });

    }

}

PHP

Copy

使用 jwt 请求 /api/user 正确的通过的验证

至此通过password模式的加密和解密已经完成了；
然鹅坑爹的是如果使用authorization code模式；
因为id是从 code 获取的；
而不是从模型中获取的；
因此我们需要在获取 code 的步骤中加密 user_id ；
先来覆盖原本的 AuthorizationController 中的approve方法；

php artisan make:controller Oauth/AuthorizationController

Bash

Copy

<?php

namespace App\Http\Controllers\Oauth;

use Illuminate\Http\Request;

use Laravel\Passport\Http\Controllers\ApproveAuthorizationController as Controller;

use Zend\Diactoros\Response as Psr7Response;

use Hashids;

class ApproveAuthorizationController extends Controller

{

    public function approve(Request $request)

    {

        return $this->withErrorHandling(function () use ($request) {

            $authRequest = $this->getAuthRequestFromSession($request);

            /**

             * Encrypt user_id

             *

             * @see \App\OauthAuthCode::setRawAttributes()

             */

            $user = $authRequest->getUser();

            $user->setIdentifier(Hashids::encode($user->getIdentifier()));

            return $this->convertResponse(

                $this->server->completeAuthorizationRequest($authRequest, new Psr7Response)

            );

        });

    }

}

PHP

Copy

覆盖路由；
routes/web.php

/*

|--------------------------------------------------------------------------

| oauth

|--------------------------------------------------------------------------

*/

Route::prefix('oauth')->namespace('Oauth')->group(function () {

    Route::post('authorize', 'ApproveAuthorizationController@approve')->name('passport.authorizations.approve');

});

PHP

Copy

此处有一个坑爹的地方；
passport 在向 oauth_auth_code 表中存储数据的时候使用了 setRawAttributes ；

以至于我们不能使用 setUserIdAttribute 来解密；
因此需要覆盖 OauthAuthCode 模型的 setRawAttributes 方法用于解密；

php artisan make:model OauthAuthCode

Bash

Copy

app/OauthAuthCode.php

<?php

namespace App;

use Hashids;

use Laravel\Passport\AuthCode;

class OauthAuthCode extends AuthCode

{

    /**

     * 因为 laravel passport 在 @see \Laravel\Passport\Bridge\AuthCodeRepository@persistNewAuthCode() 中使用的 setRawAttributes ； 而 setRawAttributes 不能触发 setUserIdAttribute ；所以不能使用 setUserIdAttribute 解密；需要 覆盖 setRawAttributes 方法；

     *

     * @param array $attributes

     * @param bool  $sync

     *

     * @return $this

     */

    public function setRawAttributes($attributes, $sync = false)

    {

        /**

         * Decrypt user_id

         *

         * Encrypt user_id in @see \App\Http\Controllers\Oauth\AuthorizationController::authorize()

         */

        if (isset($attributes['user_id'])) {

            $attributes['user_id'] = current(Hashids::decode($attributes['user_id']));

        }

        return parent::setRawAttributes($attributes, $sync);

    }

}

PHP

Copy

app/Providers/AuthServiceProvider.php

<?php

namespace App\Providers;

use App\Extensions\Illuminate\Auth\ExtendedUserProvider;

use App\OauthAccessToken;

+ use App\OauthAuthCode;

use Auth;

use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;

use Laravel\Passport\Passport;

class AuthServiceProvider extends ServiceProvider

{

    /**

     * The policy mappings for the application.

     *

     * @var array

     */

    protected $policies = [

        'App\Model' => 'App\Policies\ModelPolicy',

    ];

    /**

     * Register any authentication / authorization services.

     *

     * @return void

     */

    public function boot()

    {

        $this->registerPolicies();

        Passport::routes();

        Passport::useTokenModel(OauthAccessToken::class);

+      Passport::useAuthCodeModel(OauthAuthCode::class);

        /**

         * Register @see \App\Extensions\Illuminate\Auth\ExtendedUserProvider

         */

        Auth::provider('extended', function ($app, $config) {

            $model = $config['model'];

            return new ExtendedUserProvider($app['hash'], $model);

        });

    }

}