マイクロサービスでのセキュリティ- ClojureでのAuthとPedestalを使ったAPI

├── Capstanfile 
├── config
│ ├── conf.edn
│ └── logback.xml ├── Dockerfile
├── project.clj ├── README.md
├── resources
├── src
│ ├── clj
│ │　　└── helping_hands 
│ │　　　　└── auth
│ │　　　　├── config.clj 
│ │　　　　├── core.clj
│ │　　　　├── jwt.clj
│ │　　　　├── persistence.clj 
│ │　　　　├── server.clj
│ │　　　　├── service.clj 
│ │　　　　└── state.clj
│ └── jvm 
└── test
　　├── clj
　　│　　└── helping_hands 
　　│　　　　└── auth
　　│　　　　　　├── core_test.clj 
　　│　　　　　　└── service_test.clj
　　└── jvm　　　　
　　　　　　
 12 directories, 14 files

   (defproject helping-hands-auth "0.0.1-SNAPSHOT"
     :description "Helping Hands Auth Service"
     :url
   "https://www.packtpub.com/application-development/microservices-clojure"
     :license {:name "Eclipse Public License"
               :url "http://www.eclipse.org/legal/epl-v10.html"}
     :dependencies [[org.clojure/clojure "1.8.0"]
                    [io.pedestal/pedestal.service "0.5.3"]
                    [io.pedestal/pedestal.jetty "0.5.3"] 
[com.datomic/datomic-free "0.9.5561.62"] ;; Omniconf
[com.grammarly/omniconf "0.2.7"]
;; Mount
[mount "0.1.11"]
;; nimbus-jose for JWT [com.nimbusds/nimbus-jose-jwt "5.4"]
;; used for roles and permissions [agynamix/permissions "0.2.2-SNAPSHOT"] ;; logger
[org.clojure/tools.logging "0.4.0"] [ch.qos.logback/logback-classic "1.1.8"
                 :exclusions [org.slf4j/slf4j-api]]
               [org.slf4j/jul-to-slf4j "1.7.22"]
               [org.slf4j/jcl-over-slf4j "1.7.22"]
               [org.slf4j/log4j-over-slf4j "1.7.22"]]
:min-lein-version "2.0.0"
:source-paths ["src/clj"]
:java-source-paths ["src/jvm"]
:test-paths ["test/clj" "test/jvm"]
:resource-paths ["config", "resources"]
:plugins [[:lein-codox "0.10.3"]
          ;; Code Coverage
          [:lein-cloverage "1.0.9"]
          ;; Unit test docs
          [test2junit "1.2.2"]]
:codox {:namespaces :all}
:test2junit-output-dir "target/test-reports"
:profiles {:provided {:dependencies [[org.clojure/tools.reader "0.10.0"]
                                     [org.clojure/tools.nrepl "0.2.12"]]}
           :dev {:aliases
                   {"run-dev" ["trampoline" "run" "-m"
                               "helping-hands.auth.server/run-dev"]}
                 :dependencies
                   [[io.pedestal/pedestal.service-tools "0.5.3"]]
                 :resource-paths ["config", "resources"]
                 :jvm-opts ["-Dconf=config/conf.edn"]}
           :uberjar {:aot [helping-hands.auth.server]}
           :doc {:dependencies [[codox-theme-rdash "0.1.1"]]
                 :codox {:metadata {:doc/format :markdown}
                         :themes [:rdash]}}
           :debug {:jvm-opts
                   ["-server" (str "-agentlib:jdwp=transport=dt_socket,"
                                   "server=y,address=8000,suspend=n")]}}
　:main ^{:skip-aot true} helping-hands.auth.server)

(ns helping-hands.auth.jwt
　　"JWT Implementation for Auth Service" 
　　(:require [cheshire.core :as jp])
　　(:import [com.nimbusds.jose EncryptionMethod
             JWEAlgorithm JWSAlgorithm
             JWEDecrypter JWEEncrypter
             JWEHeader$Builder JWEObject Payload]
            [com.nimbusds.jose.crypto
             AESDecrypter AESEncrypter]
            [com.nimbusds.jose.jwk KeyOperation KeyUse
             OctetSequenceKey OctetSequenceKey$Builder]
            [com.nimbusds.jwt JWTClaimsSet JWTClaimsSet$Builder]
            [com.nimbusds.jwt.proc DefaultJWTClaimsVerifier]
            [com.nimbusds.jose.util Base64URL]
            [java.util Date]
            [javax.crypto KeyGenerator]
            [javax.crypto.spec SecretKeySpec]))
(def ^:cons khash-256 "SHA-256")
(defonce ^:private kgen-aes-128
  (let [keygen (KeyGenerator/getInstance "AES")
         _ (.init keygen 128)]
       keygen))
(defonce ^:private alg-a128kw
   (JWEAlgorithm/A128KW))
(defonce ^:private enc-a128cbc_hs256
   (EncryptionMethod/A128CBC_HS256))
(defn get-secret
　"Gets the secret key"
　([] (get-secret kgen-aes-128)) 
　([kgen]
   ;; must be created iff the key hasn't
   ;; been creaed earlier. Create once and
   ;; persist in an external database
  (.generateKey kgen)))
(defn get-secret-jwk
  "Generates a new JSON Web Key (JWK)"
  [{:keys [khash kgen alg] :as enc-impl} secret] 
  ;; must be created iff the key hasn't
  ;; been creaed earlier. Create once and
  ;; persist in an external database
  (.. (OctetSequenceKey$Builder. secret)
      (keyIDFromThumbprint (or khash khash-256))
      (algorithm (or alg alg-a128kw))
      (keyUse (KeyUse/ENCRYPTION))
      (build)))

(defn enckey->secret
     "Converts JSON Web Key (JWK) to the secret key"
     [{:keys [k kid alg] :as enc-key}]
     (.. (OctetSequenceKey$Builder. k)
         (keyID kid)
         (algorithm (or alg alg-a128kw))
         (keyUse (KeyUse/ENCRYPTION))
         (build)
         (toSecretKey "AES")))

;; JSON Web Key (JWK) generated earlier
   helping-hands.auth.server> (.toJSONObject jwk)
   {"kty" "oct", "use" "enc", "kid" "F5UNJYT4A-
   GpngZwRMYfs8ZuCKsmRGt08Xo_dMQrY5w", "k" "CvTaCBfdEkAlXfuOnW7pnw", "alg"
   "A128KW"}
;; extract the secret key
   helping-hands.auth.server> (def secret-extracted (jwt/enckey->secret {:k
   (.getKeyValue jwk) :kid (.getKeyID jwk)}))
   #'helping-hands.auth.server/secret-extracted
;; generate JSON Web Key that is exactly same as source
   helping-hands.auth.server> (.toJSONObject (jwt/get-secret-jwk {} secret-
   extracted))
   {"kty" "oct", "use" "enc", "kid" "F5UNJYT4A-
   GpngZwRMYfs8ZuCKsmRGt08Xo_dMQrY5w", "k" "CvTaCBfdEkAlXfuOnW7pnw", "alg"
   "A128KW"}
   helping-hands.auth.server> (.toJSONObject jwk)
   {"kty" "oct", "use" "enc", "kid" "F5UNJYT4A-
   GpngZwRMYfs8ZuCKsmRGt08Xo_dMQrY5w", "k" "CvTaCBfdEkAlXfuOnW7pnw", "alg"
   "A128KW"}

(defn- create-payload
     "Creates a payload as JWT Claims"
     [{:keys [user roles] :as params}]
     (let [ts (System/currentTimeMillis)
           claims (.. (JWTClaimsSet$Builder.)
                      (issuer "Packt")
                      (subject "HelpingHands")
                      (audience "https://www.packtpub.com") 
                      (issueTime (Date. ts)) 
                      (expirationTime (Date. (+ ts 120000))) 
                      (claim "user" user)
                      (claim "roles" roles)
                      (build))]
       (.toJSONObject claims)))
(defn create-token
  "Creates a new token with the given payload" 
  [{:keys [user roles alg enc] :as params} secret] 
  (let [enckey (get-secret-jwk params secret)
        payload (create-payload {:user user :roles roles})
        passphrase (JWEObject.
                    (.. (JWEHeader$Builder.
                        (or alg alg-a128kw)
                        (or enc enc-a128cbc_hs256))
                        (build))
                     (Payload. payload))
         encrypter (AESEncrypter. enckey)
         _ (.encrypt passphrase encrypter)]
   (.serialize passphrase)))
(defn read-token
  "Decrypts the given token with the said algorithm
   Throws BadJWTException is token is invalid or expired"
  [token secret]
  (let [passphrase (JWEObject/parse token)
        decrypter (AESDecrypter. secret)
        _ (.decrypt passphrase decrypter)
        payload (.. passphrase getPayload toString)
        claims (JWTClaimsSet/parse payload)
        ;; throws exception if the token is invalid
        _ (.verify (DefaultJWTClaimsVerifier.) claims)]
       (jp/parse-string payload)))

;; generate a new token with the user and roles
helping-hands.auth.server> (def token (jwt/create-token {:user "hhuser"
:roles #{"hh/notify"}} secret))
#'helping-hands.auth.server/token

;; dump the compact serialization string
helping-hands.auth.server> token
"eyJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiQTEyOEtXIn0.FiAelEg_R8We8xEF2xRxcC
908BCoH1nRYvY3nV_jkqYO8JPp-QukBw.86-
JKq6cYFH2rtFBOXiA6A.Pxz3ZzBGKX2Cd_sjtYdEwKDltzKQiolWSvrjPbLLGL8NlShcWWEIqkd
7NL2WcXHukDa6zS4ANIWnee2hNWUraItqZFEY6N_RhXZVVXQvZJsqzeiueBxvxc1fj1LFUKsyR6
3oOwLd5ZIIT99ItrqaYPM88enMsjchsXYBJ_Tcb-
WR6R_KirmDBxCVjqFcg7OdWjjcKTP4FcUNIQU9G8fSnQ.pfLyW8ggXV8vQnidytJmMw"
;; read the token back
helping-hands.auth.server> (pprint (jwt/read-token token secret))
{"sub" "HelpingHands",
 "aud" "https://www.packtpub.com",
 "roles" ["hh/notify"],
 "iss" "Packt",
 "exp" 1515959756,
 "iat" 1515959636,
 "user" "hhuser"}
nil
;; wait for 2 mins (expiry time as per implementation)
;; token is now expired
helping-hands.auth.server> (pprint (jwt/read-token token secret))
BadJWTException Expired JWT 
com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier. 
(DefaultJWTClaimsVerifier.java:62)

(ns helping-hands.auth.persistence 
　"Persistence Implementation for Auth Service" 
  (:require [agynamix.roles :as r]
            [cheshire.core :as jp])
  (:import [java.security MessageDigest]))
(defn get-hash
  "Creates a MD5 hash of the password"
  [creds]
  (.. (MessageDigest/getInstance "MD5")
      (digest (.getBytes creds "UTF-8"))))
(def userdb
  ;; Used ony for demonstration
  ;; TODO Persist in an external database 
  (atom
   {:secret nil
    :roles {"hh/superadmin" "*"
            "hh/admin" "hh:*"
            "hh/notify" #{"hh:notify" "notify/alert"}
            "notify/alert" #{"notify:email" "notify:sms"}}
    :users {"hhuser" {:pwd (get-hash "hhuser")
                      :roles #{"hh/notify"}}
            "hhadmin" {:pwd (get-hash "hhadmin")
                       :roles #{"hh/admin"}}
            "superadmin" {:pwd (get-hash "superadmin")
                          :roles #{"hh/superadmin"}}}}))
(defn has-access?
  "Checks for relevant permission" 
  [uid perms]
  (r/has-permission?
    (-> @userdb :users (get uid))
    :roles :permissions perms))
(defn init-db
  "Initializes the roles for permission framework"
   []
   (r/init-roles (:roles @userdb))
   userdb)

;; require the persistence namespace
   helping-hands.auth.server> (require '[helping-hands.auth.persistence :as
   p])
   nil
   ;; since there is no secret key define,
   ;; initialize the database with a secret-key
   ;; if it does not exist
   helping-hands.auth.server> (let [db (p/init-db)]
                                 ;; if key does not exist, initialize one
                                 ;; and update the database with :secret key
                                 (if-not (:secret @db)
                                   (swap! db #(assoc % :secret (jwt/get-
secret))) @db))
{:secret #object[javax.crypto.spec.SecretKeySpec 0xebc150b "javax.crypto.spec.SecretKeySpec@17ce8"], :roles {"hh/superadmin" "*", "hh/admin" "hh:*", "hh/notify" #{"notify/alert" "hh:notify"}, "notify/alert" #{"notify:email" "notify:sms"}}, :users {"hhuser" {:pwd #object["[B" 0x1b46ced7 "[B@1b46ced7"], :roles #{"hh/notify"}}, "hhadmin" {:pwd #object["[B" 0x7b9083e6 "[B@7b9083e6"], :roles #{"hh/admin"}}, "superadmin" {:pwd #object["[B" 0x64083ac1 "[B@64083ac1"], :roles #{"hh/superadmin"}}}}
;; validate that `hhuser` has the ``hh:notify`` permission helping-hands.auth.server> (p/has-access? "hhuser" #{"hh:notify"}) true
   ;; validate permissions that are not defined
helping-hands.auth.server> (p/has-access? "hhuser" #{"hh:admin"}) false
;; validate permissions that are obtained by other role references helping-hands.auth.server> (p/has-access? "hhuser" #{"hh:notify" "notify:email"})
true

(ns helping-hands.auth.state
     "Initializes State for Auth Service"
     (:require [mount.core :refer [defstate] :as mount]
               [helping-hands.auth.jwt :as jwt]
               [helping-hands.auth.persistence :as p]))
   (defstate auth-db
     :start (let [db (p/init-db)]
              ;; if key does not exist, initialize one
              ;; and update the database with :secret key
              (if-not (:secret @db)
                (swap! db #(assoc % :secret (jwt/get-secret))) @db))
:stop nil)

(ns helping-hands.auth.server
  (:gen-class) ; for -main method in uberjar
  (:require [io.pedestal.http :as server]
            [io.pedestal.http.route :as route]
            [mount.core :as mount]
            [helping-hands.auth.config :as cfg]
            [helping-hands.auth.service :as service]))
;; This is an adapted service map, that can be started and stopped
;; From the REPL you can call server/start and server/stop on this service
(defonce runnable-service (server/create-server service/service))
(defn run-dev
　"The entry-point for 'lein run-dev'"
  [& args]
  (println "\nCreating your [DEV] server...")
  ;; initialize configuration
  (cfg/init-config {:cli-args args :quit-on-error true}) 
  ;; initialize state
   (mount/start)
  ;; Add shutdown-hook
   (.addShutdownHook
    (Runtime/getRuntime)
    (Thread. mount/stop))
   (-> service/service ;; start with production configuration
       ...
       ;; Wire up interceptor chains
       server/default-interceptors
       server/dev-interceptors
       server/create-server
       server/start))
(defn -main
  "The entry-point for 'lein run'"
  [& args]
  (println "\nCreating your server...")
  ;; initialize configuration
  (cfg/init-config {:cli-args args :quit-on-error true}) ;; initialize state
  (mount/start)
  ;; Add shutdown-hook
  (.addShutdownHook
    (Runtime/getRuntime)
    (Thread. mount/stop)) 
  (server/start runnable-service))

(ns helping-hands.auth.service
　(:require [helping-hands.auth.core :as core]
            [cheshire.core :as jp]
            [io.pedestal.http :as http]
            [io.pedestal.http.route :as route]
            [io.pedestal.http.body-params :as body-params]
            [io.pedestal.interceptor.chain :as chain]
            [ring.util.response :as ring-resp]))
;; Defines "/" and "/about" routes with their associated :get handlers.
;; The interceptors defined after the verb map (e.g., {:get home-page}
;; apply to / and its children (/about).
(def common-interceptors [(body-params/body-params) http/html-body])
;; Tabular routes
(def routes #{["/tokens"
               :get (conj common-interceptors 
                          `core/validate `core/get-token)
               :route-name :token-get] 
              ["/tokens/validate"
               :post (conj common-interceptors
                           `core/validate `core/validate-token)
               :route-name :token-validate]})
;; See http/default-interceptors for additional options you can configure
(def service {:env :prod
              ::http/routes routes
              ::http/resource-path "/public"
              ::http/type :jetty
              ::http/port 8080
              ;; Options to pass to the container (Jetty)
              ::http/container-options {:h2c? true
                                        :h2? false
                                        :ssl? false}})

(ns helping-hands.auth.core
   "Initializes Helping Hands Auth Service"
   (:require [cheshire.core :as jp]
             [clojure.string :as s]
             [helping-hands.auth.jwt :as jwt]
             [helping-hands.auth.persistence :as p]
             [helping-hands.auth.state :refer [auth-db]]
             [io.pedestal.interceptor.chain :as chain])
   (:import [com.nimbusds.jwt.proc BadJWTException]
            [java.io IOException]
            [java.text ParseException]
            [java.util Arrays UUID]))
 ;; --------------------------------
 ;; Validation Interceptors
 ;; --------------------------------
(defn- prepare-valid-context
　　"Applies validation logic and returns the resulting context" 
　　[context]
　　(let [params (merge (-> context :request :form-params)
　　　　　　　　　　　　　　(-> context :request :query-params)
　　　　　　　　　　　　　　(-> context :request :headers)
　　　　　　　　　　　　　　(if-let [pparams (-> context :request :path-params)]
                         (if (empty? pparams) {} pparams)))]
     (if (or (and (params :uid) (params :pwd))
             (params "authorization"))
       (assoc context :tx-data params)
       (chain/terminate
        (assoc context
               :response {:status 400
　　　　　　　　　　　　　　　　:body "Invalid Creds/Token"})))))
(def validate 
  {:name ::validate
   :enter
   (fn [context]
     (prepare-valid-context context))
   :error
   (fn [context ex-info]
      (assoc context
             :response {:status 500
                        :body (.getMessage ex-info)}))})

(defn- extract-token
　"Extracts user and roles map from the auth header" 
　[auth]
　(select-keys
    (jwt/read-token
     (second (s/split auth #"\s+")) (auth-db :secret))
    ["user" "roles"]))
(def get-token 
　{:name ::token-get
   :enter
   (fn [context]
     (let [tx-data (:tx-data context)
           uid (:uid tx-data)
           pwd (:pwd tx-data)
           auth (tx-data "authorization")]
        (cond
          (and uid pwd (Arrays/equals
                        (-> auth-db :users (get uid) :pwd)
                        (p/get-hash pwd)))
          (let [token (jwt/create-token
                       {:roles (-> auth-db :users (get uid) :roles)
                        :user uid} (auth-db :secret))]
            (assoc context :response
                   {:status 200
                    :headers {"authorization" (str "Bearer " token)}}))
          (and auth (= "Bearer" (-> (s/split auth #"\s+") first)))
          (try
            (assoc context :response
                   {:status 200
                    :body (jp/generate-string (extract-token auth))})
            (catch BadJWTException e
              (assoc context :response
                     {:status 401 :body "Token expired"})))
                      :else (assoc context :response {:status 401}))))
           :error
            (fn [context ex-info]
              (assoc context
                     :response {:status 500
                               :body (.getMessage ex-info)}))})

(def validate-token 
　 {:name ::token-validate
    :enter
    (fn [context]
      (let [tx-data (:tx-data context)
            auth (tx-data "authorization")
            perms (if-let [p (tx-data :perms)]
                    (into #{} (map s/trim (s/split p #","))))]
        (if (and auth (= "Bearer" (-> (s/split auth #"\s+") first)))
          (try
            (if (p/has-access? ((extract-token auth) "user") perms)
              (assoc context :response {:status 200 :body "true"})
              (assoc context :response {:status 200 :body "false"}))
            (catch BadJWTException e
              (assoc context :response
                     {:status 401 :body "Token expired"}))
            (catch ParseException e
              (assoc context :response
                     {:status 401 :body "Invalid JWT"})))
          (assoc context :response {:status 401}))))
      :error
      (fn [context ex-info]
        (assoc context
               :response {:status 500
                          :body (.getMessage ex-info)}))})

helping-hands.auth.server> (def server (run-dev))
Creating your [DEV] server...

Omniconf configuration:
{:conf #object[java.io.File 0x979c2d2 "config/conf.edn"]}
#'helping-hands.auth.server/server
helping-hands.auth.server>

> curl -i "http://localhost:8080/tokens"
HTTP/1.1 400 Bad Request
Date: Sun, 14 Jan 2018 20:49:48 GMT
...
Invalid Creds/Token
> curl -i -XPOST -d "perms=notify:email"
"http://localhost:8080/tokens/validate"
HTTP/1.1 400 Bad Request
Date: Sun, 14 Jan 2018 20:50:21 GMT
...
Invalid Creds/Token

> curl -i "http://localhost:8080/tokens?uid=hhuser&pwd=hello"
HTTP/1.1 401 Unauthorized
Date: Sun, 14 Jan 2018 20:53:16 GMT
...
> curl -i -H "Authorization: Bearer abc" -XPOST -d "perms=notify:email" "http://localhost:8080/tokens/validate"
HTTP/1.1 401 Unauthorized
Date: Sun, 14 Jan 2018 20:55:35 GMT
...
Invalid JWT

> curl -i "http://localhost:8080/tokens?uid=hhuser&pwd=hhuser" HTTP/1.1 200 OK
Date: Sun, 14 Jan 2018 20:59:48 GMT
...
Authorization: Bearer
eyJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiQTEyOEtXIn0.YY_dMY8qoqfTHeZwGacsFY7
0tCaUvCjjPKYNFhuA2ppOD-
Deaj5zzw.BbK36SSYyuUeVVS9jpyIXw.6UNkLFMVF5Foj5qFX5vLdKcyOoU2G2eeVtHskSWBoZu
BnnAwI1NGrPc3PvQqKF4QkzlrbFfOYD2Vxd4YqYmj8Hcb1qVUQD1QgtYKiStIMujH--
ZRltPfy7m8VW1D31ToeqAYU1LLlXYSC1W3kSjZQiMFMU1LXkMqZVdmJyfQIL_SvizfWbYuZQPcy
DCxG5-XtVeG2r09vnvUybw8tKdafg.WML7xCZ-lZur1GXpNFNKrw
Transfer-Encoding: chunked
> curl -i -H "Authorization: Bearer eyJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiQTEyOEtXIn0.YY_dMY8qoqfTHeZwGacsFY7 0tCaUvCjjPKYNFhuA2ppOD- Deaj5zzw.BbK36SSYyuUeVVS9jpyIXw.6UNkLFMVF5Foj5qFX5vLdKcyOoU2G2eeVtHskSWBoZu BnnAwI1NGrPc3PvQqKF4QkzlrbFfOYD2Vxd4YqYmj8Hcb1qVUQD1QgtYKiStIMujH-- ZRltPfy7m8VW1D31ToeqAYU1LLlXYSC1W3kSjZQiMFMU1LXkMqZVdmJyfQIL_SvizfWbYuZQPcy DCxG5-XtVeG2r09vnvUybw8tKdafg.WML7xCZ-lZur1GXpNFNKrw" "http://localhost:8080/tokens"
HTTP/1.1 200 OK
Date: Sun, 14 Jan 2018 21:00:11 GMT
...
{"user":"hhuser","roles":["hh/notify"]}
> curl -XPOST -i -H "Authorization: Bearer eyJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiQTEyOEtXIn0.YY_dMY8qoqfTHeZwGacsFY7 0tCaUvCjjPKYNFhuA2ppOD- Deaj5zzw.BbK36SSYyuUeVVS9jpyIXw.6UNkLFMVF5Foj5qFX5vLdKcyOoU2G2eeVtHskSWBoZu BnnAwI1NGrPc3PvQqKF4QkzlrbFfOYD2Vxd4YqYmj8Hcb1qVUQD1QgtYKiStIMujH-- ZRltPfy7m8VW1D31ToeqAYU1LLlXYSC1W3kSjZQiMFMU1LXkMqZVdmJyfQIL_SvizfWbYuZQPcy DCxG5-XtVeG2r09vnvUybw8tKdafg.WML7xCZ-lZur1GXpNFNKrw" -d "perms=notify:email" "http://localhost:8080/tokens/validate"
HTTP/1.1 200 OK
Date: Sun, 14 Jan 2018 21:00:38 GMT
...
true%
> curl -XPOST -i -H "Authorization: Bearer eyJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiQTEyOEtXIn0.YY_dMY8qoqfTHeZwGacsFY7 0tCaUvCjjPKYNFhuA2ppOD- Deaj5zzw.BbK36SSYyuUeVVS9jpyIXw.6UNkLFMVF5Foj5qFX5vLdKcyOoU2G2eeVtHskSWBoZu BnnAwI1NGrPc3PvQqKF4QkzlrbFfOYD2Vxd4YqYmj8Hcb1qVUQD1QgtYKiStIMujH-- ZRltPfy7m8VW1D31ToeqAYU1LLlXYSC1W3kSjZQiMFMU1LXkMqZVdmJyfQIL_SvizfWbYuZQPcy DCxG5-XtVeG2r09vnvUybw8tKdafg.WML7xCZ-lZur1GXpNFNKrw" -d "perms=notify:random" "http://localhost:8080/tokens/validate"
HTTP/1.1 200 OK
Date: Sun, 14 Jan 2018 21:00:49 GMT
...