Install the JWT integration
Install JWT from Azion Marketplace and run it on a firewall to validate JSON Web Tokens before requests reach your infrastructure.
You install the JWT integration from Azion Marketplace and run it on a Firewall, from Azion Console. Access tokens control access to online resources, such as APIs and media archives, and JSON Web Tokens (JWTs) simplify this control, although a JWT can be larger than a session ID and affect network speed. The integration validates each token on the firewall, before the request reaches your infrastructure, without a call to an authenticator server. You grant and revoke privileges with KIDs and secrets, and you set expiration dates.
Five objects have to exist before a request is validated: the installed function, a firewall carrying the Functions module, a function instance holding the arguments, a Rules Engine rule with the Run Function behavior, and a workload deployment bound to the firewall. Each section below creates one of them.
Prerequisites
- An Azion account. To sign in, refer to How to access Azion Console.
- An application served by a workload, whose deployment you bind to the firewall in the last section.
- The Azion CLI installed and authorized, for the last section.
- Turning on a product or a module can generate usage costs. For more information, refer to Pricing.
Install the integration
The function is installed once per account. To install it:
Access Azion Console > Marketplace.
Enter JWT in the Search on Marketplace field, then select the integration’s card. Browsing the cards and the categories reaches the same page.
The card shows Successfully installed! and Latest version installed!, and the function appears in the Function list of the Create Instance drawer.
Create the firewall
The firewall is where the function is instanced and where the rule that runs it lives. To create one:
Access Azion Console > Firewalls, then create a firewall.
In the General section, enter a Name. For example: jwt-firewall.
In the Modules section, turn on the Functions switch.
The firewall shows a Functions Instances tab while the Functions module stays on. To use an existing firewall instead, turn on its Functions module and save it. For every setting on this form, refer to Set a firewall’s main settings.
Create the function instance
The instance holds the KIDs and secrets that the function accepts. To create it:
In Firewalls, select your firewall, then select the Functions Instances tab.
A firewall that has no instance shows the same action as Function Instance. The Create Instance drawer opens.
In Name, enter a name. For example: jwt.
In Function, select the JWT function. The list holds only the functions that run on a firewall.
In Arguments, the editor is prefilled with the integration’s default arguments in JSON. Enter your KIDs, as the next section describes.
The instance is listed in the Functions Instances tab.
Arguments
The editor loads an example of KIDs, like the one below:
Create the rule
The instance validates nothing until a rule runs it. A Rules Engine for Firewall rule selects the requests that reach the instance, through a Run Function behavior. To create the rule:
In Firewalls, select your firewall, then select the Rules Engine tab.
In Name, enter a name. For example: Run JWT.
In the Criteria section, select the domains that run the integration. For example: if Host matches yourdomain.com.
In the Behaviors section, select Run Function, then select the instance by the name you gave it.
The firewall runs the instance on every request to the domain in the criterion.
Bind the firewall to the workload
The binding is on the workload’s deployment. Access Azion Console > Workloads, open the workload, and name your firewall in the Firewall field of Deployment Settings. Workload settings lists every field a deployment holds.
Requests to the workload’s domain reach the firewall, and the rule runs the JWT instance on each one.
Run the instance on an API path
An API checks the token on the path every API route starts with, so a request without a valid token is refused before it reaches the API origin. The token travels in the request’s Authorization header, in the Bearer scheme. The example instances the function as api-jwt, with the key ID and secret key pairs your token issuer signs with, and runs it on /v1/ of api.example.com. Replace each value with your own.
To instance the JWT function:
Access Azion Console > Firewalls, select the firewall, then go to the Functions Instances tab.
Enter api-jwt.
In the Arguments tab, replace the example with your pairs, each key ID mapped to its secret key:
To run it on the API paths:
Enter api - check token.
In the Criteria section, select Request Uri, starts with, and /v1/.
In the Behaviors section, select Run Function, then api-jwt.
A request to /v1/ with an invalid token receives 400 or 401, depending on the error. A route your API serves without a token needs its own path outside /v1/, or a criterion that excludes it from this rule.
To confirm the check, send a request with no Authorization header:
The command prints 400 or 401. The same request with a valid Authorization: Bearer <token> header reaches the API.
The Protect public APIs from abuse use case uses the values of this example.
These checks confirm the Protect public APIs from abuse use case.