nsmcp::BearerAuthenticator method authenticate (public)

 <instance of nsmcp::BearerAuthenticator> authenticate \
    authorization server

Defined in /usr/local/ns/tcl/nsmcp/security.tcl

Authenticate a bearer header for the selected server. Validate token syntax, resolve its digest and check expiry before creating a request-owned context.

Parameters:

authorization (required)

Authorization header supplied by the caller.

server (required)

Selected NaviServer virtual-server name.

Returns:

A RequestContext object, or an HTTP 401 error on rejection.

Testcases:

No testcase defined.

Source code:

if {![regexp {^Bearer ([A-Za-z0-9._~+/-]+=*)$} $authorization -> token]} {
    return [next]
}
set digest [ns_crypto::md string -digest sha256 -- $token]
if {![nsv_get ${:store} $digest record] ||
    ([dict get $record expires] != 0 && [dict get $record expires] <= [clock seconds])} {
    return [next]
}
return [::nsmcp::RequestContext new  -principal [dict get $record principal]  -permissions [dict get $record permissions]  -targets [dict get $record targets] -server $server]

XQL Not present:

Generic, PostgreSQL, Oracle