Cookie Authentication with Scalatra and JWTs
Tags: scala, cookies, jwt, scalatra
Published: 2018-05-02 15:56:25

---
title: Cookie Authentication with Scalatra and JWTs
published: true
description: A walkthrough of simple Scalatra application authentication using JWTs passed in cookies
tags: scala, cookies, jwt, scalatra
cover_image: https://thepracticaldev.s3.amazonaws.com/i/yolf3ryyl4o272qvnjfl.png
---
_Originally posted on [jmkoni.com](https://www.jenniferkonikowski.com/blog/2018/5/2/cookie-authentication-using-scalatra-and-jwts)_

As part of my work with [Arcadia](https://arcadia.io), I've built a Rails application that added a cookie that contains a [JWT](https://jwt.io/) (pronounced jot). Great! That was fairly simple. Then I had to go over to our Scala application and get it to accept the JWT as identification. Right now, we were keeping it pretty simple and we only care if it's valid. This post will cover what I think is the simplest way to do that, from start to finish. Or you can skip all that and just go look at the [full gist](https://gist.github.com/jmkoni/0b1c807f014f8d6f4fc8abe442b0161d).

We want to start off with the JWT parsing. And before we add the code to actually do that, let's add some tests! I decided to use the [JWT Scala library](http://pauldijou.fr/jwt-scala/) and, in particular, [jwt-core](http://pauldijou.fr/jwt-scala/samples/jwt-core/). It had, in my opinion, the most easy-to-understand documentation so I could indeed RTFM and get my work done. Since I didn't need to add encoding in the actual application (the tokens would be encoded in another application), I added a quick line to encode a token within the tests.

{% gist https://gist.github.com/jmkoni/2397d0bdd0966057f7f9c769a50c92e7 %}

Now that I have my tests, let's add the actual code to decode the JWT! Thanks to JWT Scala, this is pretty simple! The real secret sauce is in this line: `userTokenData = parse(decoded).extract[Token].data`. That does a lot of heavy lifting! `decoded` is just a string and parse turns it into this `Jvalue` object thanks to json4s, but that object is a bit hard to work with. However, I can extract it out to my case class, `Token`, which is downright magical. If it doesn't include all the fields that I have in `Token`, it will produce an error. Perfect!

{% gist https://gist.github.com/jmkoni/63114562c67a371db1297877f47fe6fe %}

Next I need a reusable `Authentication` object. This wasn't too bad because I found out that `HttpServletRequest` has a method called `getCookies` which... returns the cookies. Excellent. I'm sure this looks weird as an `Either`, but in this case I really did want `Some` or `None` because I didn't care about returning the error to the actual user. I did want to log it though, hence the liberal use of `println`.

{% gist https://gist.github.com/jmkoni/87850a359bc8a2e9c50f33e125b6826a %}

Last, but definitely not least, I need a servlet. Well... tests for the servlet, then the servlet 😛. This is where I actually ran into trouble because I wasn't sure how to pass cookies to the `get` request in a test. With some help from my boss, we found out that `get` takes a `headers` param and you can pass a cookie if it looks like this: `headers = Map("Cookie" -> cookie_value)`. To be honest, it required a bit of trial and error and I'm still trying to figure out exactly what values are being passed.

![Whhhyyyy Scala!!!!](https://thepracticaldev.s3.amazonaws.com/i/yolf3ryyl4o272qvnjfl.png)

{% gist https://gist.github.com/jmkoni/243eded9df9008b1a4a627088b7728fa %}

And finally... my servlet! Short and sweet.
 
{% gist https://gist.github.com/jmkoni/017847a7947366f7ee415777323a1e66 %}