asmhatreandClaude Sonnet 5.5
13e8de2193
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017ic4b6XzpJxZ25cDyuw1Uk
45 lines
2.2 KiB
Bash
Executable File
45 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Starts the packaged app, walks login -> refresh -> replay with curl, and writes output/12-http-walkthrough.txt.
|
|
# Tokens are shortened in the transcript; the real ones are used on the wire.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
mvn -B -q -DskipTests package
|
|
JAR=$(ls target/refresh-tokens-demo-*.jar | head -1)
|
|
PIDFILE=$(mktemp)
|
|
setsid nohup java -jar "$JAR" > /tmp/refresh-demo.log 2>&1 < /dev/null &
|
|
echo $! > "$PIDFILE"
|
|
trap 'kill "$(cat "$PIDFILE")" 2>/dev/null || true' EXIT
|
|
for i in $(seq 1 60); do
|
|
curl -s -o /dev/null -X POST localhost:8080/api/auth/login && break
|
|
sleep 1
|
|
done
|
|
|
|
short() { echo "${1:0:14}..."; }
|
|
post() { curl -s -w '\nHTTP %{http_code}' -X POST -H 'Content-Type: application/json' -d "$2" "localhost:8080$1"; }
|
|
|
|
OUT=output/12-http-walkthrough.txt
|
|
{
|
|
echo '$ curl -X POST /api/auth/login (alice)'
|
|
LOGIN=$(curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"alice","password":"alice-password"}' localhost:8080/api/auth/login)
|
|
A=$(echo "$LOGIN" | jq -r .refresh_token); ACCESS=$(echo "$LOGIN" | jq -r .access_token)
|
|
echo "$LOGIN" | jq -c --arg a "$(short "$ACCESS")" --arg r "$(short "$A")" '.access_token=$a | .refresh_token=$r'
|
|
|
|
echo; echo '$ curl /api/me (Bearer access token)'
|
|
curl -s -w '\nHTTP %{http_code}\n' -H "Authorization: Bearer $ACCESS" localhost:8080/api/me | sed -E 's/"sid":"([0-9a-f]{8})[^"]*"/"sid":"\1..."/'
|
|
|
|
echo; echo '$ curl -X POST /api/auth/refresh (token A)'
|
|
R1=$(curl -s -X POST -H 'Content-Type: application/json' -d "{\"refresh_token\":\"$A\"}" localhost:8080/api/auth/refresh)
|
|
B=$(echo "$R1" | jq -r .refresh_token)
|
|
echo "$R1" | jq -c --arg a "$(short "$(echo "$R1" | jq -r .access_token)")" --arg r "$(short "$B")" '.access_token=$a | .refresh_token=$r'
|
|
|
|
echo; echo '$ curl -X POST /api/auth/refresh (token A again: the replay)'
|
|
post /api/auth/refresh "{\"refresh_token\":\"$A\"}"
|
|
|
|
echo; echo; echo '$ curl -X POST /api/auth/refresh (token B, the innocent holder)'
|
|
post /api/auth/refresh "{\"refresh_token\":\"$B\"}"
|
|
echo
|
|
} > "$OUT"
|
|
cat "$OUT"
|
|
echo; echo "--- server log lines about reuse ---"
|
|
grep -i 'REUSE' /tmp/refresh-demo.log | sed -E 's/^[0-9T:.+-]+ +//' || true
|