An infrastructure should be designed to be secure without sacrifice performance and operativity.
Example in python flask:
def token_required(f):
@wraps(f)
def token_dec(*args, **kwargs):
= request.headers.get('token')
token if not token:
return retDict({"status":"token rejected","message":"Missing Token!"}, 400)
if token != app.config['SECRET_KEY']:
return retDict({"status":"token rejected","message":"Invalid Token"}, 401)
return f(*args, **kwargs)
return token_dec
Example in go gorilla/mux
func generateJWT() (tokenString string, err error) {
token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
"iat": time.Now().Unix(),
"exp": time.Now().Add(time.Hour * 1).Unix()})
tokenString, err = token.SignedString([]byte("secret"))
return tokenString, err
}
func authenticateRequest(authHeader string) bool {
data, err := base64.StdEncoding.DecodeString(authHeader)
if err != nil {
fmt.Println("error:", err)
return false
}
userpwd := strings.Split(string(data), ":")
userpwdmap := userpassword()
if userpwdmap[userpwd[0]] == userpwd[1] {
return true
}
return false
}
func authenticateJWT(header http.Header) bool {
jwtString := header.Get("Authentication")
if len(jwtString) == 0 {
return false
}
token, err := jwt.Parse(jwtString, func(token *jwt.Token) (interface{}, error) {
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
}
return []byte("secret"), nil
})
if err == nil && token.Valid {
return true
} else {
return false
}
return false
}
Example in nginx with apache2 password generation
location /secret.html {
auth_basic "Administrator s Area";
auth_basic_user_file /etc/apache2/.htpasswd;
}