Use token introspection endpoint instead of userinfo

Karol-2 · May 15, 2024 · b8f852b · b8f852b
1 parent 4b26923
commit b8f852b
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 4 deletions.
diff --git a/backend/src/kcAdminClient.ts b/backend/src/kcAdminClient.ts
@@ -2,6 +2,9 @@ import KeycloakAdminClient from "@keycloak/keycloak-admin-client";
 
 export const keycloakUri = process.env.KEYCLOAK_URI || "http://localhost:3000";
 export const keycloakIssuer = process.env.KEYCLOAK_ISSUER || keycloakUri;
+export const keycloakCredentials = Buffer.from(
+  `mercury-backend:${process.env.CLIENT_SECRET}`,
+).toString("base64");
 
 const kcAdminClient = new KeycloakAdminClient({
   baseUrl: keycloakUri,

diff --git a/backend/src/misc/jwt.ts b/backend/src/misc/jwt.ts
@@ -4,7 +4,11 @@ import { AuthResponse, CustomResponse } from "../models/Response.js";
 import DecodedData from "../models/DecodedData.js";
 import Issuer from "../models/Issuer.js";
 import TokenPayload from "../models/TokenPayload.js";
-import { keycloakIssuer, keycloakUri } from "../kcAdminClient.js";
+import {
+  keycloakCredentials,
+  keycloakIssuer,
+  keycloakUri,
+} from "../kcAdminClient.js";
 
 export interface JWTRequest extends Request {
   token?: TokenPayload;
@@ -37,12 +41,14 @@ function tokenIssuerToName(issuer: string): Issuer | "unknown" {
 
 export async function verifyKeycloakToken(tokenStr: string): Promise<boolean> {
   const response = await fetch(
-    `${keycloakUri}/realms/mercury/protocol/openid-connect/userinfo`,
+    `${keycloakUri}/realms/mercury/protocol/openid-connect/token/introspect`,
     {
-      method: "GET",
+      method: "POST",
       headers: {
-        "Authorization": `Bearer ${tokenStr}`,
+        "Content-Type": "application/x-www-form-urlencoded",
+        "Authorization": `Basic ${keycloakCredentials}`,
       },
+      body: `token=${tokenStr}`,
     },
   );