Verify jwt locally

CFC_WebApp/api/cfc_webapp.py

@@ -10,10 +10,12 @@
 import time
 # So that we can set the socket timeout
 import socket
-# For decoding tokens using the google decode URL
-# We want to switch this to something offline later
+# For decoding JWTs using the google decode URL
 import urllib
 import requests
+# For decoding JWTs on the client side
+import oauth2client.client
+from oauth2client.crypt import AppIdentityError
 
 config_file = open('config.json')
 config_data = json.load(config_file)
@@ -351,23 +353,31 @@ def after_request():
 # This should only be used by createUserProfile since we may not have a UUID
 # yet. All others should use the UUID.
 def verifyUserToken(token):
-  constructedURL = ("https://www.googleapis.com/oauth2/v1/tokeninfo?id_token=%s"%token)
-  r = requests.get(constructedURL)
-  tokenFields = json.loads(r.content)
-  in_client_key = tokenFields['audience']
-  if (in_client_key != client_key):
-    if (in_client_key != hack_client_key):
-      abort(401, "Invalid client key %s" % in_client_key)
+  # attempt to validate token on the client-side
+  try:
+    tokenFields = verify_id_token(token, client_key)
+  except AppIdentityError:
+    try:
+      tokenFields = verify_id_token(token, hack_client_key)
+    except AppIdentityError:
+      # fall back to verifying using Google API
+      constructedURL = ("https://www.googleapis.com/oauth2/v1/tokeninfo?id_token=%s" % token)
+      r = requests.get(constructedURL)
+      tokenFields = json.loads(r.content)
+      in_client_key = tokenFields['audience']
+      if (in_client_key != client_key):
+        if (in_client_key != hack_client_key):
+          abort(401, "Invalid client key %s" % in_client_key)
+
   logging.debug("Found user email %s" % tokenFields['email'])
   return tokenFields['email']
 
 def getUUIDFromToken(token):
-    userEmail = verifyUserToken(token)
-    user=User.fromEmail(userEmail)
-    if user is None:
-      return None
-    user_uuid=user.uuid
-    return user_uuid
+  userEmail = verifyUserToken(token)
+  user = User.fromEmail(userEmail)
+  if user is None:
+    return None
+  return user.uuid
 
 def getUUID(request):
   retUUID = None

requirements.txt

@@ -7,3 +7,4 @@ requests==2.5.1
 six==1.9.0
 utm==0.3.1
 wsgiref==0.1.2
+google-api-python-client==1.1