Packages
guardian
0.3.1
2.4.0
2.3.2
2.3.1
2.3.0
2.2.4
2.2.3
2.2.2
2.2.1
2.2.0
2.1.2
2.1.1
2.0.0
1.2.1
1.2.0
retired
1.1.1
1.1.0
1.0.1
1.0.0
1.0.0-beta.1
1.0.0-beta.0
0.14.6
0.14.5
0.14.4
0.14.3
retired
0.14.2
0.14.1
0.14.0
0.13.0
0.12.0
0.11.1
0.10.1
0.10.0
0.9.1
0.9.0
0.8.1
0.8.0
0.7.4
0.7.2
0.7.1
0.7.0
0.6.3
0.6.2
0.6.1
0.6.0
0.5.2
0.5.0
0.4.1
0.4.0
0.3.1
0.3.0
0.2.0
0.1.1
0.1.0
Elixir Authentication framework
Current section
Files
Jump to
Current section
Files
lib/guardian/plug/verify_authorization.ex
defmodule Guardian.Plug.VerifyAuthorization do
@moduledoc """
Use this plug to verify a token contained in the header.
You should set the value of the Authorization header to:
Authorization: <jwt>
## Example
plug Guardian.Plug.VerifyAuthorization
If using CSRF you should also encode the CSRF token either
* Into the X-CSRF-TOKEN header
* Into the \_csrf\_token param
* Use the session plug to load it from there
## Example
plug Guardian.Plug.VerifyAuthorization, key: :secret
Verifying the session will update the claims on the request, available with Guardian.Plug.claims/1
In the case of an error, the claims will be set to { :error, reason }
"""
import Guardian.Keys
import Guardian.CSRFProtection
def init(opts \\ %{}), do: Enum.into(opts, %{})
def call(conn, opts) do
key = Dict.get(opts, :key, :default)
if Guardian.Plug.current_token(conn, key) do
conn
else
verify_token(conn, Plug.Conn.get_req_header(conn, "authorization"), key)
end
end
defp verify_token(conn, [], _), do: conn
defp verify_token(conn, [token|_], key) do
case Guardian.verify(token, %{ csrf: fetch_csrf_token(conn) }) do
{ :ok, claims } -> Plug.Conn.assign(conn, claims_key(key), { :ok, claims })
{ :error, reason } -> Plug.Conn.assign(conn, claims_key(key), { :error, reason })
end
end
defp fetch_csrf_token(conn) do
csrf_from_header(conn) || csrf_from_params(conn) || csrf_from_session(conn)
end
end