Merge pull request #63 from POORT8/codex/validate-token-and-throw-exception-if-invalid

Add TokenValidationResult checks

Author: mabvanaartrijk

Poort8.Ishare.Core/AuthenticationService.cs

@@ -58,6 +58,15 @@ public async Task ValidateToken(string token, string validIssuer, bool tokenRepl
             if (tokenReplayAllowed) tokenValidationParameters.ValidateTokenReplay = false;
 
             var validationResult = await handler.ValidateTokenAsync(token, tokenValidationParameters);
+            if (validationResult.IsValid == false)
+            {
+                logger.LogError(
+                    "Token validation error, for valid issuer {validIssuer} and token {token}. With message: {msg}",
+                    validIssuer,
+                    token,
+                    validationResult.Exception?.Message);
+                throw validationResult.Exception ?? new Exception("Token validation failed");
+            }
 
             ValidateIssAndSub(token, validIssuer, validationResult);
             ValidateIatAndExp(token, validIssuer, validationResult);

Poort8.Ishare.Core/SatelliteService.cs

@@ -164,6 +164,11 @@ private async Task<JsonWebToken> SatelliteTokenValidation(string token)
     {
         var handler = new JsonWebTokenHandler { MaximumTokenSizeInBytes = 1024 * 1024 * 2 };
 
+        var jsonWebToken = handler.ReadJsonWebToken(token);
+        var chain = AuthenticationService.GetCertificateChain(jsonWebToken);
+        var signingCertificate = new X509Certificate2(Convert.FromBase64String(chain[0]));
+        var signingKey = new X509SecurityKey(signingCertificate);
+
         //NOTE: As we trust the satellite and get the tokens from a predefined url over HTTPS we only do basic token validation.
         var tokenValidationParameters = new TokenValidationParameters()
         {
@@ -177,11 +182,19 @@ private async Task<JsonWebToken> SatelliteTokenValidation(string token)
             RequireExpirationTime = true,
             ClockSkew = TimeSpan.FromSeconds(10),
             RequireSignedTokens = true,
+            IssuerSigningKey = signingKey,
+            ValidateIssuerSigningKey = true
         };
 
-        await handler.ValidateTokenAsync(token, tokenValidationParameters);
+        var validationResult = await handler.ValidateTokenAsync(token, tokenValidationParameters);
+        if (validationResult.IsValid == false)
+        {
+            logger.LogError("Satellite token validation error: {msg}", validationResult.Exception?.Message);
+            throw validationResult.Exception ?? new Exception("Satellite token validation failed");
+        }
 
-        return handler.ReadJsonWebToken(token);
+        logger.LogInformation("Satellite token validation successful");
+        return jsonWebToken;
     }
 
     private async Task SetAuthorizationHeader()