Abstract:

This video details significant improvements to an OAuth client implementation in Common Lisp, focusing on robust JSON Web Token (JWT) verification and structured configuration management. It demonstrates how to move away from hardcoded global variables by defining a dedicated configuration class and injecting it via middleware. A core component of the update is the comprehensive verification of id_token JWTs, including fetching public keys from a JSON Web Key Set (JWKS) URI, validating signatures using the Ironclad library, and performing crucial checks on token validity, issuer, audience, and nonce. The video emphasizes building a secure and reliable authentication system, laying the groundwork for future integration with the OpenID Connect protocol.

Improving an OAuth Client in Common Lisp with JWT Verification

• 0:00 Initial Code Improvements: The video starts by addressing the issue of hardcoded global variables in the previously built OAuth client, aiming for a more robust and maintainable solution.
• 0:13 Structured Configuration (Class-based): A new oauth-config class is introduced to encapsulate all necessary client details, including client-id, client-secret, and a crucial jwk-uri (JSON Web Key Set URI) which provides public keys for token verification.
• 0:28 External Configuration File: Configuration data is stored in a separate config.lisp file, explicitly stating it should not be committed to version control.
• 0:50 Middleware for Configuration Injection: To avoid global variables, a middleware structure (using a Lisp web framework like Lack) is implemented. This middleware loads the oauth-config and injects it as a local variable into the request environment, ensuring contextual access.
• 2:05 OAuth Callback & Token Acquisition: The oauth-callback route handles redirects from the authorization server. It uses the received code and state to make a POST request to the token-url, obtaining access_token, refresh_token, and id_token.
• 3:06 Access vs. ID Tokens: Differentiates between access_token (for authenticating to resource services) and id_token (always a JWT, containing user information), highlighting the importance of verifying the latter.
• 3:20 JWT Structure Inspection: The inspect-token function (from the Jose library) is demonstrated to examine a JWT's payload (e.g., name, email, nonce), header (e.g., signature algorithm like RS256, kid), and signature. The kid is essential for identifying the correct public key.
• 4:47 Public Key Retrieval (JWKS): The fetch-jwks function is explained. It performs a GET request to the jwk-uri, parses the JSON response, and extracts the kid, n (modulus), and e (exponent) from RSA keys to construct a public key object using the Ironclad cryptographic library.
• 6:22 Comprehensive JWT Verification (check-jwt): The check-jwt function uses the fetched public key to verify the token's signature. Beyond signature validation, it checks the token's validity time (expiration), issuer (who issued the token), audience (who the token is for, i.e., the client ID), and the nonce (a unique string to prevent replay attacks).
• 7:55 Token Storage and Future Steps: The video suggests storing the verified id_token in the user's session for subsequent requests. The speaker concludes by emphasizing the foundational understanding gained for building secure authentication and setting the stage for integrating OpenID Connect.
• 8:36 Key Takeaway: The overall goal is to leverage Common Lisp for business logic while relying on robust, existing solutions for common problems like authentication, rather than reinventing core security mechanisms.