苹果三方登录，校验identityToken方式，golang服务端处理
苹果登录，校验identityToken方式
概述
苹果授权登录之后返回用户ID，authorizationCode及identityToken，其中：
- authorizationCode 对应一种同苹果服务器交互的验证方式，国内三方登录，例如微信登录之类的都是这种验证方式，不过本文不涉及。
- identityToken 通过苹果服务器获取到的公钥进行token解密验证的方式，看起来密钥是轮动的，也很巧妙的实现了验证token是有效的，同时能够通过对比信息来确保信息的正确性
参考
苹果官方文档
https://blog.csdn.net/we_are_the_world_123/article/details/114943076
https://xyccstudio.cn/blogs/xblog/ios/login.html
验证流程
获取苹果的公钥
地址如下：点击查看
https://appleid.apple.com/auth/keys
获取到的内容如下：
{
"keys": [
{
"kty": "RSA",
"kid": "fh6Bs8C",
"use": "sig",
"alg": "RS256",
"n": "u704gotMSZc6CSSVNCZ1d0S9dZKwO2BVzfdTKYz8wSNm7R_KIufOQf3ru7Pph1FjW6gQ8zgvhnv4IebkGWsZJlodduTC7c0sRb5PZpEyM6PtO8FPHowaracJJsK1f6_rSLstLdWbSDXeSq7vBvDu3Q31RaoV_0YlEzQwPsbCvD45oVy5Vo5oBePUm4cqi6T3cZ-10gr9QJCVwvx7KiQsttp0kUkHM94PlxbG_HAWlEZjvAlxfEDc-_xZQwC6fVjfazs3j1b2DZWsGmBRdx1snO75nM7hpyRRQB4jVejW9TuZDtPtsNadXTr9I5NjxPdIYMORj9XKEh44Z73yfv0gtw",
"e": "AQAB"
},
{
"kty": "RSA",
"kid": "YuyXoY",
"use": "sig",
"alg": "RS256",
"n": "1JiU4l3YCeT4o0gVmxGTEK1IXR-Ghdg5Bzka12tzmtdCxU00ChH66aV-4HRBjF1t95IsaeHeDFRgmF0lJbTDTqa6_VZo2hc0zTiUAsGLacN6slePvDcR1IMucQGtPP5tGhIbU-HKabsKOFdD4VQ5PCXifjpN9R-1qOR571BxCAl4u1kUUIePAAJcBcqGRFSI_I1j_jbN3gflK_8ZNmgnPrXA0kZXzj1I7ZHgekGbZoxmDrzYm2zmja1MsE5A_JX7itBYnlR41LOtvLRCNtw7K3EFlbfB6hkPL-Swk5XNGbWZdTROmaTNzJhV-lWT0gGm6V1qWAK2qOZoIDa_3Ud0Gw",
"e": "AQAB"
},
{
"kty": "RSA",
"kid": "W6WcOKB",
"use": "sig",
"alg": "RS256",
"n": "2Zc5d0-zkZ5AKmtYTvxHc3vRc41YfbklflxG9SWsg5qXUxvfgpktGAcxXLFAd9Uglzow9ezvmTGce5d3DhAYKwHAEPT9hbaMDj7DfmEwuNO8UahfnBkBXsCoUaL3QITF5_DAPsZroTqs7tkQQZ7qPkQXCSu2aosgOJmaoKQgwcOdjD0D49ne2B_dkxBcNCcJT9pTSWJ8NfGycjWAQsvC8CGstH8oKwhC5raDcc2IGXMOQC7Qr75d6J5Q24CePHj_JD7zjbwYy9KNH8wyr829eO_G4OEUW50FAN6HKtvjhJIguMl_1BLZ93z2KJyxExiNTZBUBQbbgCNBfzTv7JrxMw",
"e": "AQAB"
}
]
}
解密token
分析token
一个identityToken的例子：
eyJraWQiOiJmaDZCczhDIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL2FwcGxlaWQuYXBwbGUuY29tIiwiYXVkIjoiY29tLnRqZ2QuZGV2ZWxvcC5tb2JpbGV6Lldpc2VUViIsImV4cCI6MTY5MTY0Mzc3MSwiaWF0IjoxNjkxNTU3MzcxLCJzdWIiOiIwMDA0NDAuM2E5M2Y3MDY1NTE0NGY5Mjg5ZGJlY2Q2ODhhMmQxNzguMDc0NSIsImNfaGFzaCI6IjkyOEVmVEliSkVVUDBVQlhNRF9wZHciLCJlbWFpbCI6InRqZ2RpcHR2QGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjoidHJ1ZSIsImF1dGhfdGltZSI6MTY5MTU1NzM3MSwibm9uY2Vfc3VwcG9ydGVkIjp0cnVlfQ.gt1DjUwX5oAzmYyoVoFtqjWv8D3SXkBm327RnadilOQxYbLLM82l45EWozjykRMhMtH4bWsP47m6DtBvwfA13kQg9HNTFCYOdm7j2SnF_3S5m_6sHvaxkK0VDbuk3Z-aWOcMlHMj4kFOdM9EMC5-1Qr_k9y6i7RRmh_xkAoapoFwSlLCb41J9qnornTbZnRT3CMgMngY90uxvlowYj38YpFW5Q1YDEQVtpDTz55yVIN7yPZ5bUlOHgj2wFWp_2IVo2qKCVgC4-qtoxsRDlR_Wghmv5lh_uwMGAkwBcsTS0eP0fGuYPNoZYuYzpiaLV9j3v01N191xgfUzKVa584Zeg
jwt token通过.把token分为三部分，第一部分 header 记录了加密方式，第二部分 body 是token记录的信息，第三部分是签名。
此token的三部分如下：
header
{
"kid": "fh6Bs8C",
"alg": "RS256"
}
body
{
"iss": "https://appleid.apple.com",
"aud": "com.xxxxxx",
"exp": 1691643771,
"iat": 1691557371,
"sub": "000440.3a93f70655144f9289dbecd688a2d178.0745",
"c_hash": "928EfTIbJEUP0UBXMD_pdw",
"email": "xxxxxx",
"email_verified": "true",
"auth_time": 1691557371,
"nonce_supported": true
}
签名
gt1DjUwX5oAzmYyoVoFtqjWv8D3SXkBm327RnadilOQxYbLLM82l45EWozjykRMhMtH4bWsP47m6DtBvwfA13kQg9HNTFCYOdm7j2SnF_3S5m_6sHvaxkK0VDbuk3Z-aWOcMlHMj4kFOdM9EMC5-1Qr_k9y6i7RRmh_xkAoapoFwSlLCb41J9qnornTbZnRT3CMgMngY90uxvlowYj38YpFW5Q1YDEQVtpDTz55yVIN7yPZ5bUlOHgj2wFWp_2IVo2qKCVgC4-qtoxsRDlR_Wghmv5lh_uwMGAkwBcsTS0eP0fGuYPNoZYuYzpiaLV9j3v01N191xgfUzKVa584Zeg
验证token
通过header解析出来的kid来选择一个密钥并且使用密钥进行token验证。
校验载荷
token没什么问题之后再校验一下上述body里边的内容同apple相关内容是否一致。即完成整体流程的验证。
整体流程代码
package login
import (
"crypto/rsa"
"encoding/base64"
"encoding/json"
"errors"
"io"
"math/big"
"net/http"
"strings"
"github.com/dgrijalva/jwt-go"
)
const (
PUBLIC_KEY_REQ_URL = "https://appleid.apple.com/auth/keys"
APPLE_URL = "https://appleid.apple.com"
APPLICATION_CLIENT_ID = "com.tjgd.develop.mobilez.WiseTV"
)
type JwtClaims struct {
jwt.StandardClaims
}
type JwtHeader struct {
Kid string `json:"kid"`
Alg string `json:"alg"`
}
type JwtKeys struct {
Kty string `json:"kty"`
Kid string `json:"kid"`
Use string `json:"use"`
Alg string `json:"alg"`
N string `json:"n"`
E string `json:"e"`
}
func VerifyIdentityToken(cliToken string, cliUserID string) error {
cliTokenArr := strings.Split(cliToken, ".")
if len(cliTokenArr) < 3 {
return errors.New("cliToken Split err")
}
cliHeader, err := jwt.DecodeSegment(cliTokenArr[0])
if err != nil {
return err
}
var jHeader JwtHeader
err = json.Unmarshal(cliHeader, &jHeader)
if err != nil {
return err
}
token, err := jwt.ParseWithClaims(cliToken, &JwtClaims{}, func(token *jwt.Token) (interface{}, error) {
pk := GetRSAPublicKey(jHeader.Kid)
return pk, nil
})
if err != nil {
return err
}
if claims, ok := token.Claims.(*JwtClaims); ok && token.Valid {
if claims.Issuer != APPLE_URL || claims.Audience != APPLICATION_CLIENT_ID || claims.Subject != cliUserID {
return errors.New("verify token info fail, info is not match")
}
} else {
return errors.New("token claims parse fail")
}
return nil
}
func GetRSAPublicKey(kid string) *rsa.PublicKey {
var body []byte
resp, err := http.Get(PUBLIC_KEY_REQ_URL)
if err != nil {
return nil
} else {
defer resp.Body.Close()
_body, err := io.ReadAll(resp.Body)
if err != nil {
return nil
}
body = _body
}
var jKeys map[string][]JwtKeys
err = json.Unmarshal(body, &jKeys)
if err != nil {
return nil
}
var pubKey rsa.PublicKey
for _, data := range jKeys {
for _, val := range data {
if val.Kid == kid {
n_bin, _ := base64.RawURLEncoding.DecodeString(val.N)
n_data := new(big.Int).SetBytes(n_bin)
e_bin, _ := base64.RawURLEncoding.DecodeString(val.E)
e_data := new(big.Int).SetBytes(e_bin)
pubKey.N = n_data
pubKey.E = int(e_data.Uint64())
break
}
}
}
if pubKey.E <= 0 {
return nil
}
return &pubKey
}
使用事例
package main
import (
"fmt"
"xyccstudio/login"
)
func main() {
err := login.VerifyIdentityToken("eyJraWQiOiJmaDZCczhDIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL2FwcGxlaWQuYXBwbGUuY29tIiwiYXVkIjoiY29tLnRqZ2QuZGV2ZWxvcC5tb2JpbGV6Lldpc2VUViIsImV4cCI6MTY5MTY0Mzc3MSwiaWF0IjoxNjkxNTU3MzcxLCJzdWIiOiIwMDA0NDAuM2E5M2Y3MDY1NTE0NGY5Mjg5ZGJlY2Q2ODhhMmQxNzguMDc0NSIsImNfaGFzaCI6IjkyOEVmVEliSkVVUDBVQlhNRF9wZHciLCJlbWFpbCI6InRqZ2RpcHR2QGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjoidHJ1ZSIsImF1dGhfdGltZSI6MTY5MTU1NzM3MSwibm9uY2Vfc3VwcG9ydGVkIjp0cnVlfQ.gt1DjUwX5oAzmYyoVoFtqjWv8D3SXkBm327RnadilOQxYbLLM82l45EWozjykRMhMtH4bWsP47m6DtBvwfA13kQg9HNTFCYOdm7j2SnF_3S5m_6sHvaxkK0VDbuk3Z-aWOcMlHMj4kFOdM9EMC5-1Qr_k9y6i7RRmh_xkAoapoFwSlLCb41J9qnornTbZnRT3CMgMngY90uxvlowYj38YpFW5Q1YDEQVtpDTz55yVIN7yPZ5bUlOHgj2wFWp_2IVo2qKCVgC4-qtoxsRDlR_Wghmv5lh_uwMGAkwBcsTS0eP0fGuYPNoZYuYzpiaLV9j3v01N191xgfUzKVa584Zeg", "000440.3a93f70655144f9289dbecd688a2d178.0745")
fmt.Printf("check result %+v", err)
}