-
Notifications
You must be signed in to change notification settings - Fork 34
jwt api implementation #56
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weโll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
c6193b1
0f43112
59be63d
4cf1c43
7f8ed48
169c3a4
a6327a4
12cbd71
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -66,4 +66,5 @@ tcSpeclistWL=7 | |
| prescription=TMPrescription SMS | ||
| ### Redis IP | ||
| spring.redis.host=localhost | ||
| jwt.secret= | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -69,6 +69,7 @@ prescription=TMPrescription SMS | |
|
|
||
| ### Redis IP | ||
| spring.redis.host=localhost | ||
| jwt.secret= | ||
|
|
||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -68,5 +68,6 @@ tcSpeclistWL=7 | |
| prescription=TMPrescription SMS | ||
| ### Redis IP | ||
| spring.redis.host=localhost | ||
| jwt.secret= | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| package com.iemr.tm.config; | ||
|
|
||
| import org.springframework.cache.annotation.EnableCaching; | ||
| import org.springframework.context.annotation.Bean; | ||
| import org.springframework.context.annotation.Configuration; | ||
| import org.springframework.data.redis.connection.RedisConnectionFactory; | ||
| import org.springframework.data.redis.core.RedisTemplate; | ||
| import org.springframework.data.redis.serializer.Jackson2JsonRedisSerializer; | ||
| import org.springframework.data.redis.serializer.StringRedisSerializer; | ||
| import org.springframework.session.data.redis.config.ConfigureRedisAction; | ||
|
|
||
| import com.iemr.tm.data.login.Users; | ||
|
|
||
| @Configuration | ||
| @EnableCaching | ||
| public class RedisConfig { | ||
|
|
||
| @Bean | ||
| public ConfigureRedisAction configureRedisAction() { | ||
| return ConfigureRedisAction.NO_OP; | ||
| } | ||
|
|
||
| @Bean | ||
| public RedisTemplate<String, Users> redisTemplate(RedisConnectionFactory factory) { | ||
| RedisTemplate<String, Users> template = new RedisTemplate<>(); | ||
| template.setConnectionFactory(factory); | ||
|
|
||
| // Use StringRedisSerializer for keys (userId) | ||
| template.setKeySerializer(new StringRedisSerializer()); | ||
|
|
||
| // Use Jackson2JsonRedisSerializer for values (Users objects) | ||
| Jackson2JsonRedisSerializer<Users> serializer = new Jackson2JsonRedisSerializer<>(Users.class); | ||
| template.setValueSerializer(serializer); | ||
|
|
||
| return template; | ||
| } | ||
|
sandipkarmakar3 marked this conversation as resolved.
|
||
|
|
||
| } | ||
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -21,98 +21,30 @@ | |||||||||||
| */ | ||||||||||||
| package com.iemr.tm.data.login; | ||||||||||||
|
|
||||||||||||
| import java.sql.Timestamp; | ||||||||||||
| import java.io.Serializable; | ||||||||||||
|
|
||||||||||||
| import com.fasterxml.jackson.annotation.JsonIgnoreProperties; | ||||||||||||
|
|
||||||||||||
| import jakarta.persistence.Column; | ||||||||||||
| import jakarta.persistence.Entity; | ||||||||||||
| import jakarta.persistence.GeneratedValue; | ||||||||||||
| import jakarta.persistence.GenerationType; | ||||||||||||
| import jakarta.persistence.Id; | ||||||||||||
| import jakarta.persistence.Table; | ||||||||||||
|
|
||||||||||||
| import com.google.gson.annotations.Expose; | ||||||||||||
| import lombok.Data; | ||||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add validation and security measures for sensitive fields The entity contains sensitive PII data (Aadhaar, PAN) and credentials without proper validation or security measures. Recommended improvements:
@Column(name = "Password")
@JsonIgnore // Remove @Expose
private String password;
@Column(name = "AadhaarNo")
@Pattern(regexp = "^[0-9]{12}$")
@Convert(converter = AttributeEncryptor.class)
private String aadhaarNo;
@Column(name = "PAN")
@Pattern(regexp = "^[A-Z]{5}[0-9]{4}[A-Z]{1}$")
@Convert(converter = AttributeEncryptor.class)
private String pan;
@Component
public class AttributeEncryptor implements AttributeConverter<String, String> {
// Implement encryption/decryption using your security key
}Also applies to: 33-33, 34-34, 35-35, 36-36, 37-37, 38-38 There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. not required
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @sandipkarmakar3 Understood, I see that the sensitive fields have been removed from the Users class, making the validation suggestions unnecessary. โ๏ธ Learnings added
|
||||||||||||
|
|
||||||||||||
| @Entity | ||||||||||||
| @Data | ||||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Security concern: Replace @DaTa with specific Lombok annotations Using @DaTa on an entity containing sensitive information (password, PAN, Aadhaar) is risky as it generates toString() that could expose this data in logs. Replace with specific annotations: -@Data
+@Getter
+@Setter
+@EqualsAndHashCode(exclude = {"password", "pan", "aadhaarNo"})
+@ToString(exclude = {"password", "pan", "aadhaarNo"})๐ Committable suggestion
Suggested change
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||||||||||||
| @Table(name = "m_user") | ||||||||||||
| public class Users { | ||||||||||||
| @JsonIgnoreProperties(ignoreUnknown = true) | ||||||||||||
| public class Users implements Serializable { | ||||||||||||
| @Id | ||||||||||||
| @GeneratedValue(strategy = GenerationType.IDENTITY) | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "UserID") | ||||||||||||
| private Long userID; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "TitleID") private Short titleID; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "FirstName") | ||||||||||||
| private String firstName; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "MiddleName") | ||||||||||||
| private String middleName; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "lastName") | ||||||||||||
| private String lastName; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "GenderID") | ||||||||||||
| private Short genderID; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "MaritalStatusID") | ||||||||||||
| private Short maritalStatusID; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "AadhaarNo") | ||||||||||||
| private String aadhaarNo; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "PAN") | ||||||||||||
| private String pan; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "DOB") | ||||||||||||
| private Timestamp dob; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "DOJ") | ||||||||||||
| private Timestamp doj; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "QualificationID") | ||||||||||||
| private Integer qualificationID; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "UserName") | ||||||||||||
| private String userName; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "Password") | ||||||||||||
| private String password; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "AgentID") | ||||||||||||
| private String agentID; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "AgentPassword") | ||||||||||||
| private String agentPassword; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "EmailID") | ||||||||||||
| private String emailID; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "StatusID") | ||||||||||||
| private Short statusID; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "EmergencyContactPerson") | ||||||||||||
| private String emergencyContactPerson; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "EmergencyContactNo") | ||||||||||||
| private String emergencyContactNo; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "IsSupervisor") | ||||||||||||
| private Boolean isSupervisor; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "Deleted") | ||||||||||||
| private Boolean deleted; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "CreatedBy") | ||||||||||||
| private String createdBy; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "CreatedDate") | ||||||||||||
| private Timestamp createdDate; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "ModifiedBy") | ||||||||||||
| private String modifiedBy; | ||||||||||||
| @Expose | ||||||||||||
| @Column(name = "LastModDate") | ||||||||||||
| private Timestamp lastModDate; | ||||||||||||
| @Column(name = "Deleted", insertable = false, updatable = false) | ||||||||||||
| private Boolean Deleted; | ||||||||||||
|
|
||||||||||||
| } | ||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| package com.iemr.tm.repo.login; | ||
|
|
||
| import org.springframework.data.jpa.repository.Query; | ||
| import org.springframework.data.repository.CrudRepository; | ||
| import org.springframework.data.repository.query.Param; | ||
| import org.springframework.stereotype.Repository; | ||
|
|
||
| import com.iemr.tm.data.login.Users; | ||
|
|
||
| @Repository | ||
| public interface UserLoginRepo extends CrudRepository<Users, Long> { | ||
|
|
||
| @Query(" SELECT u FROM Users u WHERE u.userID = :userID AND u.Deleted = false ") | ||
| public Users getUserByUserID(@Param("userID") Long userID); | ||
|
|
||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| package com.iemr.tm.utils; | ||
|
|
||
| import java.util.Arrays; | ||
| import java.util.Optional; | ||
|
|
||
| import org.springframework.stereotype.Service; | ||
|
|
||
| import jakarta.servlet.http.Cookie; | ||
| import jakarta.servlet.http.HttpServletRequest; | ||
| import jakarta.servlet.http.HttpServletResponse; | ||
|
|
||
| @Service | ||
| public class CookieUtil { | ||
|
|
||
| public Optional<String> getCookieValue(HttpServletRequest request, String cookieName) { | ||
| Cookie[] cookies = request.getCookies(); | ||
| if (cookies != null) { | ||
| for (Cookie cookie : cookies) { | ||
| if (cookieName.equals(cookie.getName())) { | ||
| return Optional.of(cookie.getValue()); | ||
| } | ||
| } | ||
| } | ||
| return Optional.empty(); | ||
| } | ||
|
|
||
| public String getJwtTokenFromCookie(HttpServletRequest request) { | ||
| return Arrays.stream(request.getCookies()).filter(cookie -> "Jwttoken".equals(cookie.getName())) | ||
| .map(Cookie::getValue).findFirst().orElse(null); | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| package com.iemr.tm.utils; | ||
|
|
||
| import org.springframework.boot.web.servlet.FilterRegistrationBean; | ||
| import org.springframework.context.annotation.Bean; | ||
| import org.springframework.context.annotation.Configuration; | ||
|
|
||
| @Configuration | ||
| public class FilterConfig { | ||
|
|
||
| @Bean | ||
| public FilterRegistrationBean<JwtUserIdValidationFilter> jwtUserIdValidationFilter( | ||
| JwtAuthenticationUtil jwtAuthenticationUtil) { | ||
| FilterRegistrationBean<JwtUserIdValidationFilter> registrationBean = new FilterRegistrationBean<>(); | ||
| registrationBean.setFilter(new JwtUserIdValidationFilter(jwtAuthenticationUtil)); | ||
| registrationBean.addUrlPatterns("/*"); // Apply filter to all API endpoints | ||
| return registrationBean; | ||
| } | ||
|
|
||
| } |
Uh oh!
There was an error while loading. Please reload this page.