private void processToken ( String tokenData ) throws JSONException , LoginException { JSONObject json = new JSONObject ( tokenData ) ; // Validate that the token hasn't expired. ZonedDateTime expires = ZonedDateTime . parse ( json . getString ( "tokenExpires" ) ) ; ZonedDateTime now = ZonedDateTime . now ( expires . getZone ( ) ) ; if ( expires . isBefore ( now ) ) { throw new LoginException ( "Token has expired" ) ; } /* * The following check that expiringState is not null can be removed once the expiring state API is made public. Until then, * it can be enabled by setting the early access flag "login.module.expiring.state". See the documentation for how to set * the early access flag: * * https://kaazing.com/doc/5.0/admin-reference/p_configure_gateway_opts/index.html#enable-early-access-features */ if ( expiringState != null ) { // Validate that the token hasn't been used already. If not, then store it until it expires in case it is replayed. long duration = Duration . between ( now , expires ) . toMillis ( ) ; String nonce = json . getString ( "nonce" ) ; if ( expiringState . putIfAbsent ( nonce , nonce , duration , TimeUnit . MILLISECONDS ) != null ) { throw new LoginException ( String . format ( "Token nonce has already been used: %s" , nonce ) ) ; } } // Token has passed validity checks. Store the username to be used by the commit() method. this . username = json . getString ( "username" ) ; logger . fine ( String . format ( "Login: Token is valid for user %s" , username ) ) ; }
Validate the token and extract the username to add to shared state . An exception is thrown if the token is found to be invalid