hey, I have a problem about using jwt to authentic...

# ktor

[kurt_steiner]

hey, I have a problem about using jwt to authenticate, for example, I intercept the Call phase

fun Application.configureRouting() {
    intercept(ApplicationCallPipeline.Call) {
        val authentication = call.request.headers["Authentication"]
            ?: throw BadRequestException("no uid field in the request header")

        if (!authentication.startsWith("Bearer")) {
            throw BadRequestException("invalid authentication token format")
        }
    }
}

in this case, I will checkout if there is "Authentication" field in the call.request and check if the field startsWith "Bearer "

but in the authentication block, I don't know how to remove this Bearer when parsing the token, (if I don't use the Bearer , can it works ?)

authentication {
        jwt("auth-jwt") {
            this.realm = realm
            verifier(
                JWT
                    .require(Algorithm.HMAC256(secret))
                    .withAudience(audience)
                    .withIssuer(domain)
                    .build()
            )

            validate { credential ->
                if (credential.payload.audience.contains(audience)) {
                    JWTPrincipal(credential.payload)
                } else {
                    null
                }
            }

            challenge { defaultScheme, realm ->
                call.respond(HttpStatusCode.Unauthorized, Response.Err("token is not valid or has expired"))
            }

            skipWhen { call ->
                call.request.httpMethod == <http://HttpMethod.Post|HttpMethod.Post> &&
                        (call.request.path().endsWith("/login") || call.request.path().endsWith("/register"))
            }
        }
    }

[Aleksei Tirman [JB]]

You can redefine the parsing of the Authorization method using the authHeader method. You can find an example here.

[kurt_steiner]

eh, by the way, when the closure in authHeader return null, what will happen ?

[Aleksei Tirman [JB]]

The JWT authentication will fail.

[kurt_steiner]

then will the challenge be called ?

challenge { defaultScheme, realm ->
                call.respond(HttpStatusCode.Unauthorized, Response.Err("token is not valid or has expired"))
            }

[Aleksei Tirman [JB]]

Yes, it should be called then.