Use libsodium to encrypt all data, related to OAuth2

api/components/OAuth2/Component.php

@@ -3,21 +3,13 @@ declare(strict_types=1);
 
 namespace api\components\OAuth2;
 
-use api\components\OAuth2\Grants\AuthCodeGrant;
-use api\components\OAuth2\Grants\RefreshTokenGrant;
 use api\components\OAuth2\Keys\EmptyKey;
 use DateInterval;
 use League\OAuth2\Server\AuthorizationServer;
-use League\OAuth2\Server\Grant;
 use yii\base\Component as BaseComponent;
 
 class Component extends BaseComponent {
 
-    /**
-     * @var string|\Defuse\Crypto\Key
-     */
-    public $encryptionKey;
-
     /**
      * @var AuthorizationServer
      */
@@ -39,19 +31,21 @@ class Component extends BaseComponent {
                 $accessTokensRepo,
                 new Repositories\EmptyScopeRepository(),
                 new EmptyKey(),
-                $this->encryptionKey
+                '', // omit key because we use our own encryption mechanism
+                new ResponseTypes\BearerTokenResponse()
             );
-            $authCodeGrant = new AuthCodeGrant($authCodesRepo, $refreshTokensRepo, new DateInterval('PT10M'));
+            /** @noinspection PhpUnhandledExceptionInspection */
+            $authCodeGrant = new Grants\AuthCodeGrant($authCodesRepo, $refreshTokensRepo, new DateInterval('PT10M'));
             $authCodeGrant->disableRequireCodeChallengeForPublicClients();
             $authServer->enableGrantType($authCodeGrant, $accessTokenTTL);
             $authCodeGrant->setScopeRepository($publicScopesRepo); // Change repository after enabling
 
-            $refreshTokenGrant = new RefreshTokenGrant($refreshTokensRepo);
+            $refreshTokenGrant = new Grants\RefreshTokenGrant($refreshTokensRepo);
             $authServer->enableGrantType($refreshTokenGrant);
             $refreshTokenGrant->setScopeRepository($publicScopesRepo); // Change repository after enabling
 
             // TODO: make these access tokens live longer
-            $clientCredentialsGrant = new Grant\ClientCredentialsGrant();
+            $clientCredentialsGrant = new Grants\ClientCredentialsGrant();
             $authServer->enableGrantType($clientCredentialsGrant, $accessTokenTTL);
             $clientCredentialsGrant->setScopeRepository($internalScopesRepo); // Change repository after enabling
 

api/components/OAuth2/CryptTrait.php

@@ -0,0 +1,26 @@
+<?php
+declare(strict_types=1);
+
+namespace api\components\OAuth2;
+
+use Yii;
+
+/**
+ * This trait is intended to override the standard data encryption behavior
+ * with the help of \Defuse\Crypto\Crypto class, because the resultant string
+ * is much larger than the original one.
+ *
+ * The implementation under the hood relies on using libsodium library
+ * that provides more compact result values.
+ */
+trait CryptTrait {
+
+    protected function encrypt($unencryptedData): string {
+        return Yii::$app->tokens->encryptValue($unencryptedData);
+    }
+
+    protected function decrypt($encryptedData): string {
+        return Yii::$app->tokens->decryptValue($encryptedData);
+    }
+
+}

api/components/OAuth2/Grants/AuthCodeGrant.php

@@ -3,12 +3,14 @@ declare(strict_types=1);
 
 namespace api\components\OAuth2\Grants;
 
+use api\components\OAuth2\CryptTrait;
 use api\components\OAuth2\Repositories\PublicScopeRepository;
 use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
 use League\OAuth2\Server\Entities\RefreshTokenEntityInterface;
 use League\OAuth2\Server\Grant\AuthCodeGrant as BaseAuthCodeGrant;
 
 class AuthCodeGrant extends BaseAuthCodeGrant {
+    use CryptTrait;
 
     protected function issueRefreshToken(AccessTokenEntityInterface $accessToken): ?RefreshTokenEntityInterface {
         foreach ($accessToken->getScopes() as $scope) {

api/components/OAuth2/Grants/ClientCredentialsGrant.php

@@ -0,0 +1,12 @@
+<?php
+declare(strict_types=1);
+
+namespace api\components\OAuth2\Grants;
+
+use api\components\OAuth2\CryptTrait;
+use League\OAuth2\Server\Grant\ClientCredentialsGrant as BaseClientCredentialsGrant;
+
+class ClientCredentialsGrant extends BaseClientCredentialsGrant {
+    use CryptTrait;
+
+}

api/components/OAuth2/Grants/RefreshTokenGrant.php

@@ -3,6 +3,7 @@ declare(strict_types=1);
 
 namespace api\components\OAuth2\Grants;
 
+use api\components\OAuth2\CryptTrait;
 use common\models\OauthSession;
 use League\OAuth2\Server\Entities\AccessTokenEntityInterface;
 use League\OAuth2\Server\Entities\RefreshTokenEntityInterface;
@@ -12,6 +13,7 @@ use Psr\Http\Message\ServerRequestInterface;
 use Yii;
 
 class RefreshTokenGrant extends BaseRefreshTokenGrant {
+    use CryptTrait;
 
     /**
      * Previously, refresh tokens were stored in Redis.

api/components/OAuth2/ResponseTypes/BearerTokenResponse.php

@@ -0,0 +1,12 @@
+<?php
+declare(strict_types=1);
+
+namespace api\components\OAuth2\ResponseTypes;
+
+use api\components\OAuth2\CryptTrait;
+use League\OAuth2\Server\ResponseTypes\BearerTokenResponse as BaseBearerTokenResponse;
+
+class BearerTokenResponse extends BaseBearerTokenResponse {
+    use CryptTrait;
+
+}

api/components/Tokens/Component.php

@@ -94,14 +94,14 @@ class Component extends BaseComponent {
     public function encryptValue(string $rawValue): string {
         /** @noinspection PhpUnhandledExceptionInspection */
         $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
-        $cipher = base64_encode($nonce . sodium_crypto_secretbox($rawValue, $nonce, $this->encryptionKey));
+        $cipher = $this->base64UrlEncode($nonce . sodium_crypto_secretbox($rawValue, $nonce, $this->encryptionKey));
         sodium_memzero($rawValue);
 
         return $cipher;
     }
 
     public function decryptValue(string $encryptedValue): string {
-        $decoded = base64_decode($encryptedValue);
+        $decoded = $this->base64UrlDecode($encryptedValue);
         Assert::true($decoded !== false, 'passed value has an invalid base64 encoding');
         Assert::true(mb_strlen($decoded, '8bit') >= (SODIUM_CRYPTO_SECRETBOX_NONCEBYTES + SODIUM_CRYPTO_SECRETBOX_MACBYTES));
         $nonce = mb_substr($decoded, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES, '8bit');
@@ -137,4 +137,12 @@ class Component extends BaseComponent {
         return $value;
     }
 
+    private function base64UrlEncode(string $rawValue): string {
+        return rtrim(strtr(base64_encode($rawValue), '+/', '-_'), '=');
+    }
+
+    private function base64UrlDecode(string $encodedValue): string {
+        return base64_decode(str_pad(strtr($encodedValue, '-_', '+/'), strlen($encodedValue) % 4, '=', STR_PAD_RIGHT));
+    }
+
 }

api/config/config-test.php

@@ -1,9 +1,6 @@
 <?php
 return [
     'components' => [
-        'oauth' => [
-            'encryptionKey' => 'mock-encryption-key',
-        ],
         'tokens' => [
             'hmacKey' => 'tests-secret-key',
             'privateKeyPath' => codecept_data_dir('certs/private.pem'),

api/config/config.php

@@ -13,7 +13,6 @@ return [
         ],
         'oauth' => [
             'class' => api\components\OAuth2\Component::class,
-            'encryptionKey' => getenv('JWT_ENCRYPTION_KEY'),
         ],
         'tokens' => [
             'class' => api\components\Tokens\Component::class,

api/tests/functional/_steps/OauthSteps.php

@@ -18,7 +18,7 @@ class OauthSteps extends FunctionalTester {
         ]), ['accept' => true]);
         $this->canSeeResponseJsonMatchesJsonPath('$.redirectUri');
         [$redirectUri] = $this->grabDataFromResponseByJsonPath('$.redirectUri');
-        preg_match('/code=([\w-]+)/', $redirectUri, $matches);
+        preg_match('/code=([^&$]+)/', $redirectUri, $matches);
 
         return $matches[1];
     }