Package vaultWeb.security

Class MediaTokenService

java.lang.Object
vaultWeb.security.MediaTokenService
@Component public class MediaTokenService extends Object
Mints and validates short-lived, single-purpose tokens used to stream media through the media proxy.

Why this exists rather than reusing JwtUtil: a native <video>, <audio> or <img> tag cannot attach an Authorization header, so the credential has to travel in the URL. A regular access token must therefore never be used here: URLs leak into browser history, server access logs and Referer headers, and this application's access tokens are additionally accepted by the cloud-page service (both services are configured with the same jwt.secret). A leaked access token would grant the holder every endpoint of both services.

Tokens issued here are therefore:

  • signed with a dedicated key (jwt.mediaSecret), so they are rejected by JwtAuthFilter and confer no general API access;
  • scoped to a single file path, carried in the path claim and re-checked on every request, so one token cannot be replayed against another file;
  • short-lived (default 5 minutes), long enough to start playback and seek within a session but not to be usefully shared.

  • Constructor Details

    • MediaTokenService

      public MediaTokenService(@Value("${jwt.mediaSecret}") String mediaSecret, @Value("${app.media.token-ttl-seconds:300}") long ttlSeconds)

  • Method Details

    • getTtlSeconds

      public long getTtlSeconds()
      Seconds until an issued token expires; returned to the client so it can refresh in time.

    • generateToken

      public String generateToken(String username, String path)
      Issues a media token for one specific file belonging to one specific user.
      Parameters:
      username - the authenticated user the token acts on behalf of
      path - the user-root-relative file path this token is valid for
      Returns:
      a signed, short-lived media token

    • parseToken

      public io.jsonwebtoken.Claims parseToken(String token)
      Validates a media token and returns its claims.

      Signature, expiry and the purpose claim are all checked. The purpose check means that even if another token type were ever signed with this key, it could not be used to stream files.

      Parameters:
      token - the token from the request path
      Returns:
      the parsed claims
      Throws:
      io.jsonwebtoken.JwtException - if the token is invalid, expired, or not a media token

    • extractPath

      public String extractPath(io.jsonwebtoken.Claims claims)
      Extracts the file path a media token is scoped to.