Securing your app with signed headers

  using 
  
  Google.Apis.Auth 
 
 ; 
 using 
  
  Google.Apis.Auth.OAuth2 
 
 ; 
 using 
  
 System 
 ; 
 using 
  
 System.Threading 
 ; 
 using 
  
 System.Threading.Tasks 
 ; 
 public 
  
 class 
  
 IAPTokenVerification 
 { 
  
 /// <summary> 
  
 /// Verifies a signed jwt token and returns its payload. 
  
 /// </summary> 
  
 /// <param name="signedJwt">The token to verify.</param> 
  
 /// <param name="expectedAudience">The audience that the token should be meant for. 
  
 /// Validation will fail if that's not the case.</param> 
  
 /// <param name="cancellationToken">The cancellation token to propagate cancellation requests.</param> 
  
 /// <returns>A task that when completed will have as its result the payload of the verified token.</returns> 
  
 /// <exception cref="InvalidJwtException">If verification failed. The message of the exception will contain 
  
 /// information as to why the token failed.</exception> 
  
 public 
  
 async 
  
 Task<JsonWebSignature 
 . 
 Payload 
>  
 VerifyTokenAsync 
 ( 
  
 string 
  
 signedJwt 
 , 
  
 string 
  
 expectedAudience 
 , 
  
 CancellationToken 
  
 cancellationToken 
  
 = 
  
 default 
 ) 
  
 { 
  
  SignedTokenVerificationOptions 
 
  
 options 
  
 = 
  
 new 
  
  SignedTokenVerificationOptions 
 
  
 { 
  
 // Use clock tolerance to account for possible clock differences 
  
 // between the issuer and the verifier. 
  
 IssuedAtClockTolerance 
  
 = 
  
 TimeSpan 
 . 
 FromMinutes 
 ( 
 1 
 ), 
  
 ExpiryClockTolerance 
  
 = 
  
 TimeSpan 
 . 
 FromMinutes 
 ( 
 1 
 ), 
  
 TrustedAudiences 
  
 = 
  
 { 
  
 expectedAudience 
  
 }, 
  
 TrustedIssuers 
  
 = 
  
 { 
  
 "https://cloud.google.com/iap" 
  
 }, 
  
 CertificatesUrl 
  
 = 
  
  GoogleAuthConsts 
 
 . 
  IapKeySetUrl 
 
 , 
  
 }; 
  
 return 
  
 await 
  
  JsonWebSignature 
 
 . 
  VerifySignedTokenAsync 
 
 ( 
 signedJwt 
 , 
  
 options 
 , 
  
 cancellationToken 
 : 
  
 cancellationToken 
 ); 
  
 } 
 } 
 

  import 
  
 ( 
  
 "context" 
  
 "fmt" 
  
 "io" 
  
 "google.golang.org/api/idtoken" 
 ) 
 // validateJWTFromAppEngine validates a JWT found in the 
 // "x-goog-iap-jwt-assertion" header. 
 func 
  
 validateJWTFromAppEngine 
 ( 
 w 
  
 io 
 . 
 Writer 
 , 
  
 iapJWT 
 , 
  
 projectNumber 
 , 
  
 projectID 
  
 string 
 ) 
  
 error 
  
 { 
  
 // iapJWT := "YmFzZQ==.ZW5jb2RlZA==.and0" // req.Header.Get("X-Goog-IAP-JWT-Assertion") 
  
 // projectNumber := "123456789" 
  
 // projectID := "your-project-id" 
  
 ctx 
  
 := 
  
 context 
 . 
 Background 
 () 
  
 aud 
  
 := 
  
 fmt 
 . 
 Sprintf 
 ( 
 "/projects/%s/apps/%s" 
 , 
  
 projectNumber 
 , 
  
 projectID 
 ) 
  
 payload 
 , 
  
 err 
  
 := 
  
 idtoken 
 . 
 Validate 
 ( 
 ctx 
 , 
  
 iapJWT 
 , 
  
 aud 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "idtoken.Validate: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 // payload contains the JWT claims for further inspection or validation 
  
 fmt 
 . 
 Fprintf 
 ( 
 w 
 , 
  
 "payload: %v" 
 , 
  
 payload 
 ) 
  
 return 
  
 nil 
 } 
 // validateJWTFromComputeEngine validates a JWT found in the 
 // "x-goog-iap-jwt-assertion" header. 
 func 
  
 validateJWTFromComputeEngine 
 ( 
 w 
  
 io 
 . 
 Writer 
 , 
  
 iapJWT 
 , 
  
 projectNumber 
 , 
  
 backendServiceID 
  
 string 
 ) 
  
 error 
  
 { 
  
 // iapJWT := "YmFzZQ==.ZW5jb2RlZA==.and0" // req.Header.Get("X-Goog-IAP-JWT-Assertion") 
  
 // projectNumber := "123456789" 
  
 // backendServiceID := "backend-service-id" 
  
 ctx 
  
 := 
  
 context 
 . 
 Background 
 () 
  
 aud 
  
 := 
  
 fmt 
 . 
 Sprintf 
 ( 
 "/projects/%s/global/backendServices/%s" 
 , 
  
 projectNumber 
 , 
  
 backendServiceID 
 ) 
  
 payload 
 , 
  
 err 
  
 := 
  
 idtoken 
 . 
 Validate 
 ( 
 ctx 
 , 
  
 iapJWT 
 , 
  
 aud 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "idtoken.Validate: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 // payload contains the JWT claims for further inspection or validation 
  
 fmt 
 . 
 Fprintf 
 ( 
 w 
 , 
  
 "payload: %v" 
 , 
  
 payload 
 ) 
  
 return 
  
 nil 
 } 
 

  import 
  
 com.google.api.client.http. HttpRequest 
 
 ; 
 import 
  
 com.google.api.client.json.webtoken. JsonWebToken 
 
 ; 
 import 
  
 com.google.auth.oauth2. TokenVerifier 
 
 ; 
 /** Verify IAP authorization JWT token in incoming request. */ 
 public 
  
 class 
 VerifyIapRequestHeader 
  
 { 
  
 private 
  
 static 
  
 final 
  
 String 
  
 IAP_ISSUER_URL 
  
 = 
  
 "https://cloud.google.com/iap" 
 ; 
  
 // Verify jwt tokens addressed to IAP protected resources on App Engine. 
  
 // The project *number* for your Google Cloud project via 'gcloud projects describe $PROJECT_ID' 
  
 // The project *number* can also be retrieved from the Project Info card in Cloud Console. 
  
 // projectId is The project *ID* for your Google Cloud Project. 
  
 boolean 
  
 verifyJwtForAppEngine 
 ( 
  HttpRequest 
 
  
 request 
 , 
  
 long 
  
 projectNumber 
 , 
  
 String 
  
 projectId 
 ) 
  
 throws 
  
 Exception 
  
 { 
  
 // Check for iap jwt header in incoming request 
  
 String 
  
 jwt 
  
 = 
  
 request 
 . 
  getHeaders 
 
 (). 
  getFirstHeaderStringValue 
 
 ( 
 "x-goog-iap-jwt-assertion" 
 ); 
  
 if 
  
 ( 
 jwt 
  
 == 
  
 null 
 ) 
  
 { 
  
 return 
  
 false 
 ; 
  
 } 
  
 return 
  
 verifyJwt 
 ( 
  
 jwt 
 , 
  
 String 
 . 
 format 
 ( 
 "/projects/%s/apps/%s" 
 , 
  
 Long 
 . 
 toUnsignedString 
 ( 
 projectNumber 
 ), 
  
 projectId 
 )); 
  
 } 
  
 boolean 
  
 verifyJwtForComputeEngine 
 ( 
  HttpRequest 
 
  
 request 
 , 
  
 long 
  
 projectNumber 
 , 
  
 long 
  
 backendServiceId 
 ) 
  
 throws 
  
 Exception 
  
 { 
  
 // Check for iap jwt header in incoming request 
  
 String 
  
 jwtToken 
  
 = 
  
 request 
 . 
  getHeaders 
 
 (). 
  getFirstHeaderStringValue 
 
 ( 
 "x-goog-iap-jwt-assertion" 
 ); 
  
 if 
  
 ( 
 jwtToken 
  
 == 
  
 null 
 ) 
  
 { 
  
 return 
  
 false 
 ; 
  
 } 
  
 return 
  
 verifyJwt 
 ( 
  
 jwtToken 
 , 
  
 String 
 . 
 format 
 ( 
  
 "/projects/%s/global/backendServices/%s" 
 , 
  
 Long 
 . 
 toUnsignedString 
 ( 
 projectNumber 
 ), 
  
 Long 
 . 
 toUnsignedString 
 ( 
 backendServiceId 
 ))); 
  
 } 
  
 private 
  
 boolean 
  
 verifyJwt 
 ( 
 String 
  
 jwtToken 
 , 
  
 String 
  
 expectedAudience 
 ) 
  
 { 
  
  TokenVerifier 
 
  
 tokenVerifier 
  
 = 
  
  TokenVerifier 
 
 . 
 newBuilder 
 (). 
 setAudience 
 ( 
 expectedAudience 
 ). 
 setIssuer 
 ( 
 IAP_ISSUER_URL 
 ). 
 build 
 (); 
  
 try 
  
 { 
  
  JsonWebToken 
 
  
 jsonWebToken 
  
 = 
  
 tokenVerifier 
 . 
  verify 
 
 ( 
 jwtToken 
 ); 
  
 // Verify that the token contain subject and email claims 
  
  JsonWebToken 
 
 . 
  Payload 
 
  
 payload 
  
 = 
  
 jsonWebToken 
 . 
  getPayload 
 
 (); 
  
 return 
  
 payload 
 . 
  getSubject 
 
 () 
  
 != 
  
 null 
 && 
 payload 
 . 
 get 
 ( 
 "email" 
 ) 
  
 != 
  
 null 
 ; 
  
 } 
  
 catch 
  
 ( 
  TokenVerifier 
 
 . 
  VerificationException 
 
  
 e 
 ) 
  
 { 
  
 System 
 . 
 out 
 . 
 println 
 ( 
 e 
 . 
 getMessage 
 ()); 
  
 return 
  
 false 
 ; 
  
 } 
  
 } 
 } 
 

  /** 
 * TODO(developer): Uncomment these variables before running the sample. 
 */ 
 // const iapJwt = 'SOME_ID_TOKEN'; // JWT from the "x-goog-iap-jwt-assertion" header 
 let 
  
 expectedAudience 
  
 = 
  
 null 
 ; 
 if 
  
 ( 
 projectNumber 
 && 
 projectId 
 ) 
  
 { 
  
 // Expected Audience for App Engine. 
  
 expectedAudience 
  
 = 
  
 `/projects/ 
 ${ 
 projectNumber 
 } 
 /apps/ 
 ${ 
 projectId 
 } 
 ` 
 ; 
 } 
  
 else 
  
 if 
  
 ( 
 projectNumber 
 && 
 backendServiceId 
 ) 
  
 { 
  
 // Expected Audience for Compute Engine 
  
 expectedAudience 
  
 = 
  
 `/projects/ 
 ${ 
 projectNumber 
 } 
 /global/backendServices/ 
 ${ 
 backendServiceId 
 } 
 ` 
 ; 
 } 
 const 
  
 oAuth2Client 
  
 = 
  
 new 
  
 OAuth2Client 
 (); 
 async 
  
 function 
  
 verify 
 () 
  
 { 
  
 // Verify the id_token, and access the claims. 
  
 const 
  
 response 
  
 = 
  
 await 
  
 oAuth2Client 
 . 
 getIapPublicKeys 
 (); 
  
 const 
  
 ticket 
  
 = 
  
 await 
  
 oAuth2Client 
 . 
 verifySignedJwtWithCertsAsync 
 ( 
  
 iapJwt 
 , 
  
 response 
 . 
 pubkeys 
 , 
  
 expectedAudience 
 , 
  
 [ 
 'https://cloud.google.com/iap' 
 ], 
  
 ); 
  
 // Print out the info contained in the IAP ID token 
  
 console 
 . 
 log 
 ( 
 ticket 
 ); 
 } 
 verify 
 (). 
 catch 
 ( 
 console 
 . 
 error 
 ); 
 

  namespace Google\Cloud\Samples\Iap; 
 # Imports Google auth libraries for IAP validation 
 use Google\Auth\AccessToken; 
 /** 
 * Validate a JWT passed to your App Engine app by Identity-Aware Proxy. 
 * 
 * @param string $iapJwt The contents of the X-Goog-IAP-JWT-Assertion header. 
 * @param string $cloudProjectNumber The project *number* for your Google 
 *     Cloud project. This is returned by 'gcloud projects describe $PROJECT_ID', 
 *     or in the Project Info card in Cloud Console. 
 * @param string $cloudProjectId Your Google Cloud Project ID. 
 */ 
 function validate_jwt_from_app_engine( 
 string $iapJwt, 
 string $cloudProjectNumber, 
 string $cloudProjectId 
 ): void { 
 $expectedAudience = sprintf( 
 '/projects/%s/apps/%s', 
 $cloudProjectNumber, 
 $cloudProjectId 
 ); 
 validate_jwt($iapJwt, $expectedAudience); 
 } 
 /** 
 * Validate a JWT passed to your Compute / Container Engine app by Identity-Aware Proxy. 
 * 
 * @param string $iapJwt The contents of the X-Goog-IAP-JWT-Assertion header. 
 * @param string $cloudProjectNumber The project *number* for your Google 
 *     Cloud project. This is returned by 'gcloud projects describe $PROJECT_ID', 
 *     or in the Project Info card in Cloud Console. 
 * @param string $backendServiceId The ID of the backend service used to access the 
 *     application. See https://cloud.google.com/iap/docs/signed-headers-howto 
 *     for details on how to get this value. 
 */ 
 function validate_jwt_from_compute_engine( 
 string $iapJwt, 
 string $cloudProjectNumber, 
 string $backendServiceId 
 ): void { 
 $expectedAudience = sprintf( 
 '/projects/%s/global/backendServices/%s', 
 $cloudProjectNumber, 
 $backendServiceId 
 ); 
 validate_jwt($iapJwt, $expectedAudience); 
 } 
 /** 
 * Validate a JWT passed to your app by Identity-Aware Proxy. 
 * 
 * @param string $iapJwt The contents of the X-Goog-IAP-JWT-Assertion header. 
 * @param string $expectedAudience The expected audience of the JWT with the following formats: 
 *     App Engine:     /projects/{PROJECT_NUMBER}/apps/{PROJECT_ID} 
 *     Compute Engine: /projects/{PROJECT_NUMBER}/global/backendServices/{BACKEND_SERVICE_ID} 
 */ 
 function validate_jwt(string $iapJwt, string $expectedAudience): void 
 { 
 // Validate the signature using the IAP cert URL. 
 $token = new AccessToken(); 
 $jwt = $token->verify($iapJwt, [ 
 'certsLocation' => AccessToken::IAP_CERT_URL 
 ]); 
 if (!$jwt) { 
 print('Failed to validate JWT: Invalid JWT'); 
 return; 
 } 
 // Validate token by checking issuer and audience fields. 
 assert($jwt['iss'] == 'https://cloud.google.com/iap'); 
 assert($jwt['aud'] == $expectedAudience); 
 print('Printing user identity information from ID token payload:'); 
 printf('sub: %s', $jwt['sub']); 
 printf('email: %s', $jwt['email']); 
 } 
 

  from 
  
 google.auth.transport 
  
 import 
 requests 
 from 
  
 google.oauth2 
  
 import 
 id_token 
 def 
  
 validate_iap_jwt 
 ( 
 iap_jwt 
 , 
 expected_audience 
 ): 
  
 """Validate an IAP JWT. 
 Args: 
 iap_jwt: The contents of the X-Goog-IAP-JWT-Assertion header. 
 expected_audience: The Signed Header JWT audience. See 
 https://cloud.google.com/iap/docs/signed-headers-howto 
 for details on how to get this value. 
 Returns: 
 (user_id, user_email, error_str). 
 """ 
 try 
 : 
 decoded_jwt 
 = 
 id_token 
 . 
 verify_token 
 ( 
 iap_jwt 
 , 
 requests 
 . 
 Request 
 (), 
 audience 
 = 
 expected_audience 
 , 
 certs_url 
 = 
 "https://www.gstatic.com/iap/verify/public_key" 
 , 
 ) 
 return 
 ( 
 decoded_jwt 
 [ 
 "sub" 
 ], 
 decoded_jwt 
 [ 
 "email" 
 ], 
 "" 
 ) 
 except 
 Exception 
 as 
 e 
 : 
 return 
 ( 
 None 
 , 
 None 
 , 
 f 
 "**ERROR: JWT validation error 
 { 
 e 
 } 
 **" 
 ) 
 

  # iap_jwt = "The contents of the X-Goog-Iap-Jwt-Assertion header" 
 # project_number = "The project *number* for your Google Cloud project" 
 # project_id = "Your Google Cloud project ID" 
 # backend_service_id = "Your Compute Engine backend service ID" 
 require 
  
 "googleauth" 
 audience 
  
 = 
  
 nil 
 if 
  
 project_number 
 && 
 project_id 
  
 # Expected audience for App Engine 
  
 audience 
  
 = 
  
 "/projects/ 
 #{ 
 project_number 
 } 
 /apps/ 
 #{ 
 project_id 
 } 
 " 
 elsif 
  
 project_number 
 && 
 backend_service_id 
  
 # Expected audience for Compute Engine 
  
 audience 
  
 = 
  
 "/projects/ 
 #{ 
 project_number 
 } 
 /global/backendServices/ 
 #{ 
 backend_service_id 
 } 
 " 
 end 
 # The client ID as the target audience for IAP 
 payload 
  
 = 
  
 Google 
 :: 
 Auth 
 :: 
  IDTokens 
 
 . 
  verify_iap 
 
  
 iap_jwt 
 , 
  
 aud 
 : 
  
 audience 
 puts 
  
 payload 
 if 
  
 audience 
 . 
 nil? 
  
 puts 
  
 "Audience not verified! Supply a project_number and project_id to verify" 
 end