Validate userinfo endpoint in each request

[rafaelrenanpacheco]

Hello!

When using JWT as an authorization strategy the server will accept requests until the exp claim expires. If the user account is disabled, blocked, or even if the user chooses to "logout from all devices", there is currently no way to refuse incoming requests that have a valid, not expired, JWT token.

Even tho JWT authentication is used for stateless application, there is still the concept of session if the authorization server supports it. For example, Keycloak has session control for generated access/refresh tokens. Sadly, If I remove all sessions in Keycloak, nothing will happen because the server relies only on the exp claim when receiving a request.

In order to know if the JWT is still valid besides the exp and signature validation, micronaut-security could have a HttpServerFilter to ping the user-info endpoint using the JWT bearer authorization header. The authorization server (keycloak, aws cognito, etc) will validate the token looking at the user account, not only at the exp claim. If the token is invalid for whatever reason (account blocked, session invalidated, etc), the user-info endpoint will send a 401 response. That would mean for micronaut-security that the token is invalid and should send a 401 response as well.

I created a custom filter in my application using Keycloak SDK to filter the user's session, but if this idea make to micronaut-security, the user-info ping would be way better. The JWKS endpoint usually have a userinfo_endpoint to be used in this validation, or there could be an alternative property to setup the user-info to be used. Just to demonstrate what I did, here is the code:

@Filter(Filter.MATCH_ALL_PATTERN)
public class UserSessionFilter extends OncePerRequestHttpServerFilter {

    private final RealmResource realmResource;

    public UserSessionFilter(RealmResource realmResource) {
        this.realmResource = realmResource;
    }

    @Override
    protected Publisher<MutableHttpResponse<?>> doFilterOnce(HttpRequest<?> request, ServerFilterChain chain) {
        Optional<AuthenticationUserDetailsAdapter> authentication =
                request.getUserPrincipal(AuthenticationUserDetailsAdapter.class);

        if (authentication.isPresent()) {
            String userId = (String) authentication.get().getAttributes().get("sub");
            String sessionId = (String) authentication.get().getAttributes().get("session_state");

            Boolean hasSession = realmResource.users()
                    .get(userId)
                    .getUserSessions()
                    .stream()
                    .anyMatch(s -> s.getId().equals(sessionId));

            if (!hasSession) {
                return Publishers.just(new UnauthorizedException("Session expired"));
            }
        }

        return chain.proceed(request);
    }

    @Override
    public int getOrder() {
        return Ordered.LOWEST_PRECEDENCE;
    }
}

If micronaut-security will use user-info to validate each request, it would be necessary another property to enable/disable this feature as well.

What do you think about this feature?

Best regards,
Rafael Pacheco.

[sdelamo]

Moving this to discussion