Add token encrypt decrypt in cache.

Author: fdonnet

UbikLink.AppHost/Program.cs

@@ -16,6 +16,7 @@
 var rabbitUser = builder.AddParameter("rabbit-username", secret: true);
 var rabbitPassword = builder.AddParameter("rabbit-password", secret: true);
 var transportType = builder.AddParameter("transport-type", secret: false);
+var authTokenStoreKey = builder.AddParameter("auth-token-store-key", secret: true);
 
 //Postgres (local)
 var db = builder.AddPostgres("ubiklink-postgres", postgresUsername, postgresPassword)
@@ -95,6 +96,7 @@
     .WithEnvironment("AuthConfig__TokenUrl", authTokenUrl)
     .WithEnvironment("AuthConfig__ClientId", securityClientAppId)
     .WithEnvironment("AuthConfig__ClientSecret", securityClientAppSecret)
+    .WithEnvironment("AuthConfig__AuthTokenStoreKey", securityClientAppSecret)
     .WithEnvironment("Messaging__Transport", transportType)
     .WithEnvironment("Messaging__RabbitUser", rabbitUser)
     .WithEnvironment("Messaging__RabbitPassword", rabbitPassword);

UbikLink.AppHost/appsettings.json

@@ -31,5 +31,6 @@
   "Parameters:auth-metadata-url": "http://localhost:8080/realms/ubik/.well-known/openid-configuration",
   "Parameters:auth-base-url": "http://localhost:8080/realms/ubik",
   "ConnectionStrings:messaging": "xx",
-  "Parameters:keycloak-password": "admin"
+  "Parameters:keycloak-password": "admin",
+  "Parameters:auth-token-store-key": "Ye6Y36ocA4SaGqYzd0HgmqMhVaM2jlkE"
 }

UbikLink.Common/Auth/AuthConfigOptions.cs

@@ -24,5 +24,6 @@ public class AuthConfigOptions
         public List<string> Scopes { get; set; } = default!;
         public bool AuthorizeBadCert { get; set; } = false;
         public string AuthTokenHttpClientName { get; set; } = "default";
+        public string AuthTokenStoreKey { get; set; } = "default";
     }
 }

UbikLink.Common/Frontend/Auth/UserAndTokenCache.cs

@@ -2,6 +2,8 @@
 using Microsoft.Extensions.Caching.Hybrid;
 using Microsoft.Extensions.Options;
 using System.IdentityModel.Tokens.Jwt;
+using System.Security.Cryptography;
+using System.Text;
 using UbikLink.Common.Auth;
 using UbikLink.Security.Contracts.Users.Results;
 
@@ -20,6 +22,8 @@ public async Task RemoveUserTokenAsync(string key)
 
         public async Task SetUserTokenAsync(TokenCacheEntry token)
         {
+            token.AccessToken = Encrypt(token.AccessToken, _authOptions.AuthTokenStoreKey);
+            token.RefreshToken = Encrypt(token.RefreshToken, _authOptions.AuthTokenStoreKey);
             await cache.SetAsync($"{_authOptions.ClientAppName}_{token.UserId}", token, new HybridCacheEntryOptions()
             {
                 Expiration = TimeSpan.FromMinutes(_authOptions.RefreshTokenExpTimeInMinutes + 1),
@@ -36,6 +40,8 @@ public async Task SetUserTokenAsync(TokenCacheEntry token)
 
             if (token == null) return null;
 
+            token.AccessToken = Decrypt(token.AccessToken, _authOptions.AuthTokenStoreKey);
+            token.RefreshToken = Decrypt(token.RefreshToken, _authOptions.AuthTokenStoreKey);
             token = await RefreshTokenAsync(token, userId);
 
             return token;
@@ -139,5 +145,42 @@ private Dictionary<string, string> ValuesForRefresh(string token)
                 { "grant_type", "refresh_token" },
             };
         }
+
+        public static string Encrypt(string plainText, string key)
+        {
+            using Aes aesAlg = Aes.Create();
+            aesAlg.Key = Encoding.UTF8.GetBytes(key);
+            aesAlg.GenerateIV();
+            ICryptoTransform encryptor = aesAlg.CreateEncryptor(aesAlg.Key, aesAlg.IV);
+
+            using MemoryStream msEncrypt = new();
+            msEncrypt.Write(aesAlg.IV, 0, aesAlg.IV.Length);
+            using (CryptoStream csEncrypt = new(msEncrypt, encryptor, CryptoStreamMode.Write))
+            using (StreamWriter swEncrypt = new(csEncrypt))
+            {
+                swEncrypt.Write(plainText);
+            }
+            return Convert.ToBase64String(msEncrypt.ToArray());
+        }
+
+        public static string Decrypt(string cipherText, string key)
+        {
+            byte[] fullCipher = Convert.FromBase64String(cipherText);
+            using Aes aesAlg = Aes.Create();
+            aesAlg.Key = Encoding.UTF8.GetBytes(key);
+            byte[] iv = new byte[aesAlg.BlockSize / 8];
+            byte[] cipher = new byte[fullCipher.Length - iv.Length];
+
+            Array.Copy(fullCipher, iv, iv.Length);
+            Array.Copy(fullCipher, iv.Length, cipher, 0, cipher.Length);
+
+            aesAlg.IV = iv;
+            ICryptoTransform decryptor = aesAlg.CreateDecryptor(aesAlg.Key, aesAlg.IV);
+
+            using MemoryStream msDecrypt = new(cipher);
+            using CryptoStream csDecrypt = new(msDecrypt, decryptor, CryptoStreamMode.Read);
+            using StreamReader srDecrypt = new(csDecrypt);
+            return srDecrypt.ReadToEnd();
+        }
     }
 }

UbikLink.Security.UI/appsettings.json

@@ -22,6 +22,7 @@
     "ClientAppName": "Security.UI.App",
     "Scopes": [ "openid", "offline_access" ],
     "AuthorizeBadCert": false,
-    "AuthTokenHttpClientName": "security-httpclient"
+    "AuthTokenHttpClientName": "security-httpclient",
+    "AuthTokenStoreKey": "Xxxxxxx"
   }
 }