fpJWT | Example
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
cpalx · 2023-03-16 18:34

Hello, Where can i find an example of using jwt for login

i just did this

  jwt:= TJWT.Create(TJWTClaims);
  try
    jwt.Claims.iss:= issuer;
    jwt.Claims.exp:= Now + EncodeTime(0, minutesToExpire, 0, 0)]);
    jwt.Claims.sub:= subject;
    jwt.JOSE.alg:= 'HS256';
    jwt.JOSE.typ:= ''JWT;
  finally 
....


i wiill use in a cgi

----------------------------------------------------------------------
PierceNg · 2023-03-17 01:22

In HTTP, a JWT is transmitted in request header like this:
"Authorization: Bearer <jwt>". The server uses that info to make
security decisions.

How is the JWT issued to the HTTP client in the first place? By means
of some authentication mechanism.

What authentication mechanism? Depends on client. Different for human
driving web browser that is running an SPA and automated client making
REST calls, as examples.

Quote from: cpalx on March 16, 2023, 07:34:43 pmCode: [Select]  jwt:=
TJWT.Create(TJWTClaims);
  try
    jwt.Claims.iss:= issuer;
    jwt.Claims.exp:= Now + EncodeTime(0, minutesToExpire, 0, 0)]);
    jwt.Claims.sub:= subject;
    jwt.JOSE.alg:= 'HS256';
    jwt.JOSE.typ:= ''JWT;
  finally 
....
i wiill use in a cgi

It should be an authentication component that issues the JWT. I assume
your CGI program will consume the JWT.
How does the client of your CGI handle issuance and use of the JWT?

Some useful reading:

- https://blog.paolorossi.net/jwt-authentication-with-delphi-part-1/
- https://blog.logrocket.com/jwt-authentication-best-practices/
- https://stackoverflow.com/questions/27067251/where-to-store-jwt-in-
browser-how-to-protect-against-csrf

----------------------------------------------------------------------
AlexTP · 2023-03-17 07:12

I stored this useful answer to Wiki, https://wiki.freepascal.org/fpJWT

----------------------------------------------------------------------
cpalx · 2023-03-17 14:07

But, how to return the value of JWT?

something

----------------------------------------------------------------------
PierceNg · 2023-03-17 15:44

Quote from: cpalx on March 17, 2023, 03:07:30 pmBut, how to return the
value of JWT?

something

Why don't you describe how you envisage using JWT in your setup.

----------------------------------------------------------------------
paweld · 2023-03-17 15:55

@cpalx: What version of FPC do you have? 

In FPC 3.2.2 there is no signature generation yet - so you must either
use the component: https://github.com/andre-djsystem/LazJWT, or use
fpjwt to generate JOSE and Claims and using https://github.com/Xor-
el/HashLib4Pascal generate a signature, e.g.Code: Pascal
 [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i uses 
fpjwt, HlpIHashInfo, HlpConverters, HlpHashFactory, DateUtils,
Base64; procedure TForm1.FormCreate(Sender: TObject);begin 
ShowMessage(GenJwt('xxx', 'yyy', 'password', 60));end; function
TForm1.GenJwt(issuer, subject, secret_key: String; minutesToExpire:
Integer): String;var  jwt: TJWT;  LHMAC: IHMAC;  barr: TBytes;  s:
String;  i: Integer;begin  jwt := TJWT.Create;  jwt.Claims.iss:=
issuer;  jwt.Claims.exp:= DateTimeToUnix(IncMinute(Now,
minutesToExpire));  jwt.Claims.sub:= subject;  jwt.JOSE.alg:=
'HS256';  jwt.JOSE.typ:= 'JWT';  Result := jwt.JOSE.AsEncodedString +
'.' + jwt.Claims.AsEncodedString;  LHMAC :=
THashFactory.THMAC.CreateHMAC(THashFactory.TCrypto.CreateSHA2_256); 
LHMAC.Key := TConverters.ConvertStringToBytes(secret_key,
TEncoding.UTF8);  barr := LHMAC.ComputeString(Result,
TEncoding.UTF8).GetBytes();  s := '';  for i := Low(barr) to
High(barr) do    s := s + chr(barr[i]);  jwt.Signature :=
jwt.Base64ToBase64URL(EncodeStringBase64(s));  Result := Result + '.'
+ jwt.Signature;  jwt.Free;end;

----------------------------------------------------------------------
WayneSherman · 2023-03-19 01:00

Quote from: paweld on March 17, 2023, 04:55:11 pmIn FPC 3.2.2 there is
no signature generation yet...
JWT signing was added to fpc trunk in 2022:
https://gitlab.com/freepascal.org/fpc/source/-/tree/main/packages/fcl-
web/examples/jwt
https://gitlab.com/freepascal.org/fpc/source/-/tree/main/packages/fcl-
web/src/jwt

jwt commit history:
https://gitlab.com/freepascal.org/fpc/source/-
/commits/main/packages/fcl-web/src/jwt

See also:
https://gitlab.com/freepascal.org/fpc/source/-/tree/main/packages/fcl-
hash/src
https://gitlab.com/freepascal.org/fpc/source/-
/commits/main/packages/fcl-hash/src

----------------------------------------------------------------------
AlexTP · 2023-03-19 08:53

Updated the wiki info from posts,
https://wiki.freepascal.org/fpJWT#Signature_generation