aws-jwt-verifyでCognitoのアクセストークン検証をHonoのMiddlewareとして実装してみた

npm create hono@latest my-app

create-hono version 0.14.3
✔ Using target directory … my-app
? Which template do you want to use? nodejs
? Do you want to install project dependencies? yes
? Which package manager do you want to use? npm
✔ Cloning the template
✔ Installing project dependencies
🎉 Copied project files
Get started with: cd my-app

# 作成が完了したらプロジェクトへ階層を移動
cd my-app

npm install aws-jwt-verify

USER_POOL_NAME="任意のユーザープール名"
APP_CLIENT_NAME="任意のクライアントアプリ名"
EMAIL="登録するメールアドレス"
PASSWORD="パスワード（8文字以上、大小文字・数字・記号を含む）"

#!/bin/bash

# 変数設定
USER_POOL_NAME="CognitoUserPool"
APP_CLIENT_NAME="CognitoAppClient"
EMAIL="your-email"
PASSWORD="your-password"

# User Pool の作成
echo "Creating User Pool..."
USER_POOL_ID=$(aws cognito-idp create-user-pool \
    --pool-name "$USER_POOL_NAME" \
    --policies '{"PasswordPolicy":{"MinimumLength":8,"RequireUppercase":true,"RequireLowercase":true,"RequireNumbers":true,"RequireSymbols":true}}' \
    --username-attributes email \
    --query 'UserPool.Id' \
    --output text)

# User Pool Client の作成
# callback-urlsなどは検証のため適当な値を設定しています。
echo "Creating User Pool Client..."
CLIENT_ID=$(aws cognito-idp create-user-pool-client \
    --user-pool-id $USER_POOL_ID \
    --client-name "$APP_CLIENT_NAME" \
    --no-generate-secret \
    --explicit-auth-flows ALLOW_USER_PASSWORD_AUTH ALLOW_REFRESH_TOKEN_AUTH \
    --supported-identity-providers COGNITO \
    --callback-urls '["http://localhost:3000/callback"]' \
    --logout-urls '["http://localhost:3000/logout"]' \
    --allowed-o-auth-flows code \
    --allowed-o-auth-scopes "email" "openid" "profile" \
    --allowed-o-auth-flows-user-pool-client \
    --query 'UserPoolClient.ClientId' \
    --output text)

# ユーザーの登録
echo "Signing up user..."
aws cognito-idp sign-up \
    --client-id $CLIENT_ID \
    --username $EMAIL \
    --password $PASSWORD

# ユーザーの確認（admin confirm）
echo "Confirming user..."
aws cognito-idp admin-confirm-sign-up \
    --user-pool-id $USER_POOL_ID \
    --username $EMAIL

# 認証とトークンの取得
echo "Authenticating user..."
AUTH_RESULT=$(aws cognito-idp initiate-auth \
    --client-id $CLIENT_ID \
    --auth-flow USER_PASSWORD_AUTH \
    --auth-parameters USERNAME=$EMAIL,PASSWORD=$PASSWORD)

# 結果の表示
echo "Summary:"
echo "User Pool ID: $USER_POOL_ID"
echo "Client ID: $CLIENT_ID"
echo "Access Token: $(echo "$AUTH_RESULT" | jq -r '.AuthenticationResult.AccessToken')"
echo "ID Token: $(echo "$AUTH_RESULT" | jq -r '.AuthenticationResult.IdToken')"

nano create-cognito.sh

sh ./create-cognito.sh

Creating User Pool...
Creating User Pool Client...
Signing up user...
Confirming user...
Authenticating user...

Summary:
User Pool ID: ap-northeast-1_zzzz
Client ID: yyyyyy
Access Token: xxx
ID Token: yyy

aws cognito-idp initiate-auth \
    --client-id <作成したクライアントアプリケーションのID> \
    --auth-flow USER_PASSWORD_AUTH \
    --auth-parameters USERNAME=<登録したメールアドレス>,PASSWORD=<登録したパスワード>

const verifier = CognitoJwtVerifier.create({
  userPoolId: "<準備セクションで取得したUser Pool ID>",
  tokenUse: "access",
  clientId: "<準備セクションで取得したClient ID>",
});

// JWKSキャッシュの事前読み込み（オプション）
await verifier.hydrate();

// tokenを検証
await verifier.verify(token)

// キャッシュの事前読み込み
await verifier.hydrate();

// 4時間ごとにキャッシュをクリア
setInterval(
  () => {
    verifier.cacheJwks({ keys: [] }); // 空のJWKSをロードしてキャッシュをクリア
  },
  1000 * 60 * 60 * 4 // 4時間間隔
);

import { createMiddleware } from "hono/factory";

// JWT検証のMiddleware
const authMiddleware = createMiddleware(async (c, next) => {
  try {
    const token = c.req.header("authorization");

    if (!token) {
      return c.json(
        {
          message: "Authorization header missing",
        },
        401
      );
    }

    // JWTの検証
    const payload = await verifier.verify(token);
    console.log(payload);

    await next();
  } catch (error) {
    const errorMessage = error instanceof Error ? error.message : "Unknown error"
    return c.json(
      {
        message: "Token not valid",
        detail: errorMessage,
      },
      403
    );
  }
});

// Middlewareを全エンドポイントに適応
app.use("/*", authMiddleware);

npm run dev

# 実行コマンド
curl http://localhost:3000 \
  -H "Authorization: <準備セクションで取得したAccess Token>" -i

# 実行結果 
HTTP/1.1 200 OK
content-type: application/json
content-length: 26
Date: Sat, 28 Dec 2024 16:25:12 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{"message":"token valid!"}

{
  "sub": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "iss": "https://cognito-idp.ap-northeast-1.amazonaws.com/<User Pool ID>",
  "client_id": "<Client ID>",
  "token_use": "access",
  "scope": "aws.cognito.signin.user.admin",
  "auth_time": 1735402386,
  "exp": 1735405986,
  "iat": 1735402386,
  "username": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

# 実行コマンド
curl http://localhost:3000 -i

# 実行結果
HTTP/1.1 401 Unauthorized
content-type: application/json
content-length: 42
Date: Sat, 28 Dec 2024 16:24:41 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{"message":"Authorization header missing"}

# 実行コマンド
curl http://localhost:3000 \
  -H "Authorization: aaa" -i

# 実行結果
HTTP/1.1 403 Forbidden
content-type: application/json
content-length: 41
Date: Sat, 28 Dec 2024 16:28:18 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{"message":"Token not valid","detail":"JWT string does not consist of exactly 3 parts (header, payload, signature)"}

# 実行コマンド
curl http://localhost:3000 \
  -H "Authorization: <準備セクションで取得したAccess Token>a" -i

# 実行結果
HTTP/1.1 403 Forbidden
content-type: application/json
content-length: 41
Date: Sat, 28 Dec 2024 16:28:18 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{"message":"Token not valid","detail":"Invalid signature"}

# 実行コマンド
curl http://localhost:3000 \
  -H "Authorization: <有効期限が切れたAccess Token>" -i
HTTP/1.1 403 Forbidden
content-type: application/json
content-length: 80
Date: Sat, 28 Dec 2024 16:32:03 GMT
Connection: keep-alive
Keep-Alive: timeout=5

{"message":"Token not valid","detail":"Token expired at 2024-12-28T13:55:37.000Z"}