Secure a Clojure Web API with Auth0
Tags: security, clojure, webdev
Published: 2021-12-14 13:37:58

#### Learn more about how we can secure our Clojure Web API using Auth0

### <br>

In my [previous article](https://auth0.com/blog/create-an-api-server-with-clojure-and-pedestal/), we built a simple Web API in Clojure with the Pedastal framework. We covered some core concepts essential to know for writing Clojure and serving data on the web.

It was a great start! But the very next thing we should consider when building a Web API is making sure that it's secured. 

## Requirements

Of course, you'll want the source code that we ended up with at the close of the previous article. You'll also need to sign up for a free Auth0 account. You won't need a credit card, and this will be the simplest way for us to add basic Authentication.
 
### Interceptors explained
 
We have already used Interceptors while building our application. From our previous article:

> Simply put, they let you layer functions to create a "pipeline" to handle web requests.

They can also be used for responses, as we've seen with our JSON serialization example above.
 
### Building a base interceptor
 
In Pedestal, an interceptor is nothing more than a map with a `:name` along with `:enter`,  `:leave`, and `:error` keys. The name is (you guessed it) the name, while the last three items represent optional keys that receive a [context map](http://pedestal.io/reference/context-map) as an argument. Each of these keys is executed when the request is coming in when the response is being sent, and if an error happens along the way. You'll need to include at least one of these functions for this to count as an interceptor!
 
For instance, let's say we want to create an interceptor that inserts a specific response header for every response we send. To accomplish this, all we need to do is create a map with a function on the `:leave` keyword and associate the header:
 
```clojure
(def header-interceptor {
 :name "header-interceptor"
 :leave (fn [ctx] (assoc-in ctx [:response :headers "AppName"] "Pedestal-Auth0-App"))})
```
 
Pedestal also offers helpers to write a specific type of interceptor without having to specify the entire map. Here's that same function using these helpers:
 
```clojure
(require 'io.pedestal.interceptors.helpers :as helpers)
 
(def header-interceptor (helpers/on-response (fn [response] (assoc-in response [:headers "AppName"] "Pedestal-Auth0-App"))))
```
 
Armed with a basic understanding of interceptors in Pedastal, we can now set up an Auth0 account and then write our interceptor to validate any tokens provided in a request.
 
## Validating a Token

In an OAuth-compliant application, Identity providers must provide information to validate JWT tokens that they issue. Many frameworks and languages create black boxes where you provide some configuration parameters, and they do the rest. We're going to go into a bit more detail in this application. Here are some basic concepts to understand:

### JSON Web Tokens
Most documentation sources and developers shorten JSON Web Tokens to just JWT. JWTs are essentially long strings that encode JSON, and are frequently used for Authentication and Authorization. Identity providers issue JWTs and include information relevant to the apps that use them, such as your name, email address, or permissions for that app. If you're unfamiliar with JWTs I highly suggest [Auth0's documentation](https://auth0.com/docs/security/tokens/json-web-tokens) on the matter. When issued by an Identity provider, they're often signed so that you can know they're authentic, which leads us to...

### JSON Web Key Set
JSON Web Key Set's acronym is JWKS. We'll use the acronym for the remainder of this article. This key set contains the *public* keys that say, "Yeah, I made that token." The Identity provider has used a separate and private cryptographic key to construct the token. This process that allows for a public verification key and a private construction key is called asymmetric encryption. 

We'll need to retrieve the location of the JSON Web Key set for our Identity provider when we create a new Application in the Auth0 portal so we can verify JWTs. You can read a bit more about the concept in the [Auth0 documentation](https://auth0.com/docs/security/tokens/json-web-tokens/json-web-key-sets). 

### Create a new Auth0 application

Before writing the code to validate a token issued by an identity provider effectively, let's quickly review a couple of steps necessary to set up Auth0.
 
Once we've logged in, select Applications -> APIs from the left menu and create a new API. For demo purposes, we can just put a random name and an identifier. In my case, I am going to be using `clojure-pedestal` for both.

![Creating a new API in Auth0](https://images.ctfassets.net/23aumh6u8s0i/3IGLaJE64V2cWe3X4tahSX/70f98430ee2beab09b258e52f6ad5006/clojure_04.png)

When confirming the operation, Auth0 will also create a default Test application for the new API. Click on Applications -> Applications on the left menu to review the application's details. From the **Settings** tab, we will need to grab the domain. This is the base URL we'll need to determine a JWKS location.

![The Application settings we'll need to configure in Clojure](https://images.ctfassets.net/23aumh6u8s0i/7qAlQDPvlD9qLqx4k2cznV/bb18a3cbaaef5e58d31524cd5d8eadf0/clojure_05.png)

In this example, since my domain is https://dev-q6rh8--8.us.auth0.com/, my JWKS URL will be https://dev-q6rh8--8.us.auth0.com/.well-known/jwks.json

### Set up the authorization interceptor in Pedestal
 
Auth0 offers several Java libraries to work with JWT and JWK. Since Clojure has a good interoperability story with Java, we can use these libraries to write our interceptor.

[Read more...](https://auth0.com/blog/secure-a-clojure-web-api-with-auth0/?utm_source=content_synd&utm_medium=sc&utm_campaign=clojure)