diff --git a/middleware/jwt.go b/middleware/jwt.go index da00ea56b..57a4dec33 100644 --- a/middleware/jwt.go +++ b/middleware/jwt.go @@ -159,17 +159,24 @@ func JWTWithConfig(config JWTConfig) echo.MiddlewareFunc { } // Initialize - parts := strings.Split(config.TokenLookup, ":") - extractor := jwtFromHeader(parts[1], config.AuthScheme) - switch parts[0] { - case "query": - extractor = jwtFromQuery(parts[1]) - case "param": - extractor = jwtFromParam(parts[1]) - case "cookie": - extractor = jwtFromCookie(parts[1]) - case "form": - extractor = jwtFromForm(parts[1]) + // Split sources + sources := strings.Split(config.TokenLookup, ",") + var extractors []jwtExtractor + for _, source := range sources { + parts := strings.Split(source, ":") + + switch parts[0] { + case "query": + extractors = append(extractors, jwtFromQuery(parts[1])) + case "param": + extractors = append(extractors, jwtFromParam(parts[1])) + case "cookie": + extractors = append(extractors, jwtFromCookie(parts[1])) + case "form": + extractors = append(extractors, jwtFromForm(parts[1])) + case "header": + extractors = append(extractors, jwtFromHeader(parts[1], config.AuthScheme)) + } } return func(next echo.HandlerFunc) echo.HandlerFunc { @@ -181,8 +188,17 @@ func JWTWithConfig(config JWTConfig) echo.MiddlewareFunc { if config.BeforeFunc != nil { config.BeforeFunc(c) } - - auth, err := extractor(c) + var auth string + var err error + for _, extractor := range extractors { + // Extract token from extractor, if it's not fail break the loop and + // set auth + auth, err = extractor(c) + if err == nil { + break + } + } + // If none of extractor has a token, handle error if err != nil { if config.ErrorHandler != nil { return config.ErrorHandler(err) @@ -193,6 +209,7 @@ func JWTWithConfig(config JWTConfig) echo.MiddlewareFunc { } return err } + token := new(jwt.Token) // Issue #647, #656 if _, ok := config.Claims.(jwt.MapClaims); ok { diff --git a/middleware/jwt_test.go b/middleware/jwt_test.go index 205721aec..0a3bd354f 100644 --- a/middleware/jwt_test.go +++ b/middleware/jwt_test.go @@ -178,6 +178,14 @@ func TestJWT(t *testing.T) { hdrCookie: "jwt=" + token, info: "Valid cookie method", }, + { + config: JWTConfig{ + SigningKey: validKey, + TokenLookup: "query:jwt,cookie:jwt", + }, + hdrCookie: "jwt=" + token, + info: "Multiple jwt lookuop", + }, { config: JWTConfig{ SigningKey: validKey,