.forgejo/workflows/build.yml

@@ -36,6 +36,11 @@ jobs:
         with:
           name: api.yml
           path: api/api.yml
+      - name: Upload Websocket Spec as Artifact
+        uses: "https://git.euph.dev/actions/upload-artifact@v3"
+        with:
+          name: ws.yml
+          path: ws/ws.yml
       - name: "Stop Gradle"
         run: gradle --stop
 
@@ -85,6 +90,11 @@ jobs:
         with:
           name: api.yml
           path: release
+      - name: Download Websocket Spec
+        uses: "https://git.euph.dev/actions/download-artifact@v3"
+        with:
+          name: ws.yml
+          path: release
       - name: Create Release
         uses: "https://git.euph.dev/actions/release@v2"
         with:
@@ -96,6 +106,3 @@ jobs:
           release-notes: |
             # Tower Defence - Server ${{ github.ref_name }}
             Read the [Documentation](https://git.euph.dev/TowerDefence/Dokumentation/wiki/Server/Config) to see how to setup the server.
-
-
-

build.gradle.kts

@@ -53,6 +53,11 @@ dependencies {
     implementation("org.springframework.boot:spring-boot-starter-oauth2-resource-server")
     developmentOnly("org.springframework.boot:spring-boot-devtools")
 
+    //JWT
+    implementation("io.jsonwebtoken:jjwt-api:0.12.6")
+    runtimeOnly("io.jsonwebtoken:jjwt-impl:0.12.6")
+    runtimeOnly("io.jsonwebtoken:jjwt-jackson:0.12.6")
+
     // Postgres
     runtimeOnly("org.postgresql:postgresql")
 

src/main/java/de/towerdefence/server/player/session/PlayerLoginSessions.java

@@ -1,67 +0,0 @@
-package de.towerdefence.server.player.session;
-
-import de.towerdefence.server.player.Player;
-import org.springframework.stereotype.Component;
-
-import java.nio.charset.StandardCharsets;
-import java.security.SecureRandom;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.Executors;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.ScheduledFuture;
-import java.util.concurrent.TimeUnit;
-
-@Component
-public class PlayerLoginSessions {
-    public static final int PLAYER_LOGIN_SESSION_TOKEN_BYTE_LENGTH = 64;
-    private final SecureRandom random;
-    private final Map<String, String> playerLoginSessionTokens = new HashMap<>();
-    private final Map<String, Player> playerLoginSessionPlayers = new HashMap<>();
-    private final Map<String, ScheduledFuture<?>> playerLoginSessionSchedule = new HashMap<>();
-    private static final ScheduledExecutorService scheduler = Executors.newScheduledThreadPool(1);
-
-    public PlayerLoginSessions() {
-        random = new SecureRandom();
-    }
-
-    public String createPlayerLoginSession(Player player) {
-        byte[] token_data = new byte[PLAYER_LOGIN_SESSION_TOKEN_BYTE_LENGTH];
-        this.random.nextBytes(token_data);
-        String token = new String(token_data, StandardCharsets.UTF_8);
-        String playerName = player.getUsername();
-        this.playerLoginSessionTokens.put(playerName, token);
-        this.playerLoginSessionPlayers.put(playerName, player);
-        this.playerLoginSessionSchedule.put(playerName, scheduler.schedule(
-                () -> {
-                    this.playerLoginSessionTokens.remove(playerName);
-                    this.playerLoginSessionPlayers.remove(playerName);
-                    this.playerLoginSessionSchedule.remove(playerName);
-                },
-                30,
-                TimeUnit.SECONDS
-        ));
-        return token;
-    }
-
-    /**
-     * @return an Optional Player. If it is empty, that Player has no valid Login Session
-     */
-    public Optional<Player> getPlayerFromLoginSession(String username, String token) {
-        if (!this.playerLoginSessionTokens.containsKey(username)) {
-            return Optional.empty();
-        }
-        if (!this.playerLoginSessionTokens.get(username).equals(token)) {
-            return Optional.empty();
-        }
-        this.playerLoginSessionTokens.remove(username);
-        Player player = this.playerLoginSessionPlayers.get(username);
-        ScheduledFuture<?> task = this.playerLoginSessionSchedule.get(username);
-        if (task != null) {
-            task.cancel(true);
-        }
-        this.playerLoginSessionSchedule.remove(username);
-        return Optional.of(player);
-    }
-}

src/main/java/de/towerdefence/server/server/JsonMessage.java

@@ -0,0 +1,37 @@
+package de.towerdefence.server.server;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+import java.io.IOException;
+import java.util.Map;
+
+import org.springframework.web.socket.TextMessage;
+import org.springframework.web.socket.WebSocketSession;
+
+
+@Getter
+@AllArgsConstructor
+public abstract class JsonMessage {
+    protected abstract String getMessageId();
+    protected abstract Map<String, JsonNode> getData(JsonNodeFactory factory);
+
+    public void send(WebSocketSession session) throws IOException {
+        session.sendMessage(new TextMessage(getPayload()));
+    }
+
+    public String getPayload() {
+        JsonNodeFactory factory = new JsonNodeFactory(false);
+        ObjectNode msg = factory.objectNode().put("$id", getMessageId());
+        for (Map.Entry<String, JsonNode> entry : getData(factory).entrySet()) {
+            if(entry.getKey().equals("$id")){
+                continue;
+            }
+            msg.set(entry.getKey(), entry.getValue());
+        }
+        return msg.toString();
+    }
+}

src/main/java/de/towerdefence/server/server/JsonWebsocketHandler.java

@@ -0,0 +1,49 @@
+package de.towerdefence.server.server;
+
+import de.towerdefence.server.player.Player;
+import de.towerdefence.server.session.Channel;
+import de.towerdefence.server.session.SessionsService;
+import lombok.AllArgsConstructor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.socket.CloseStatus;
+import org.springframework.web.socket.WebSocketSession;
+import org.springframework.web.socket.handler.TextWebSocketHandler;
+
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+
+@AllArgsConstructor
+public abstract class JsonWebsocketHandler extends TextWebSocketHandler {
+    private static final Logger logger = LoggerFactory.getLogger(JsonWebsocketHandler.class);
+    protected final Channel channel;
+    protected final SessionsService sessionsService;
+    protected final Map<WebSocketSession, Player> sessionPlayers = new ConcurrentHashMap<>();
+
+    @Override
+    public void afterConnectionEstablished(WebSocketSession session) {
+        String jwt = session.getHandshakeHeaders().getFirst("Authorization");
+        if (jwt == null){
+            closeSession(session, CloseStatus.NOT_ACCEPTABLE);
+            return;
+        }
+        Optional<Player> player = sessionsService.getSession(jwt, channel);
+        if(player.isEmpty()){
+            closeSession(session, CloseStatus.NOT_ACCEPTABLE);
+            return;
+        }
+        sessionPlayers.put(session, player.get());
+    }
+
+    protected void closeSession(WebSocketSession session, CloseStatus reason){
+        if(session.isOpen()){
+            try{
+                session.close(reason);
+            } catch (Exception exception) {
+                logger.info("Unable to Close the Session", exception);
+            }
+        }
+    }
+
+}

src/main/java/de/towerdefence/server/server/ServerApiController.java

@@ -9,7 +9,8 @@ import de.towerdefence.server.oas.models.ServerHealth;
 import de.towerdefence.server.player.Player;
 import de.towerdefence.server.player.PlayerRepository;
 import de.towerdefence.server.player.PlayerService;
-import de.towerdefence.server.player.session.PlayerLoginSessions;
+import de.towerdefence.server.session.Channel;
+import de.towerdefence.server.session.SessionsService;
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.HttpStatus;
@@ -29,7 +30,7 @@ public class ServerApiController implements ServerApi {
     @Autowired
     private PlayerService playerService;
     @Autowired
-    private PlayerLoginSessions playerLoginSessions;
+    private SessionsService sessionsService;
 
     @Override
     public Optional<ObjectMapper> getObjectMapper() {
@@ -70,7 +71,7 @@ public class ServerApiController implements ServerApi {
         } catch (NoSuchAlgorithmException e) {
             return new ResponseEntity<>(HttpStatus.INTERNAL_SERVER_ERROR);
         }
-        String token = playerLoginSessions.createPlayerLoginSession(player);
+        String token = sessionsService.createSession(player, Channel.CONNECTION);
         PlayerLoginSession session = new PlayerLoginSession();
         session.setUsername(player.getUsername());
         session.setToken(token);

src/main/java/de/towerdefence/server/server/WebSocketConfig.java

@@ -1,15 +0,0 @@
-package de.towerdefence.server.server;
-
-import org.springframework.context.annotation.Configuration;
-import org.springframework.web.socket.config.annotation.EnableWebSocket;
-import org.springframework.web.socket.config.annotation.WebSocketConfigurer;
-import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry;
-
-@Configuration
-@EnableWebSocket
-public class WebSocketConfig implements WebSocketConfigurer {
-    @Override
-    public void registerWebSocketHandlers(WebSocketHandlerRegistry registry) {
-        registry.addHandler(new ServerWebsocketHandler(), "/ws/server").setAllowedOrigins("*");
-    }
-}

src/main/java/de/towerdefence/server/server/channels/connection/ConnectionWebsocketConfig.java

@@ -0,0 +1,24 @@
+package de.towerdefence.server.server.channels.connection;
+
+import de.towerdefence.server.session.SessionsService;
+import lombok.AllArgsConstructor;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.socket.config.annotation.EnableWebSocket;
+import org.springframework.web.socket.config.annotation.WebSocketConfigurer;
+import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry;
+
+@AllArgsConstructor
+@Configuration
+@EnableWebSocket
+public class ConnectionWebsocketConfig  implements WebSocketConfigurer {
+    @Autowired
+    private final SessionsService sessionsService;
+    @Override
+    public void registerWebSocketHandlers(WebSocketHandlerRegistry registry) {
+        registry.addHandler(
+                new ConnectionWebsocketHandler(this.sessionsService),
+                "/ws/connection"
+        ).setAllowedOrigins("*");
+    }
+}

src/main/java/de/towerdefence/server/server/channels/connection/ConnectionWebsocketHandler.java

@@ -0,0 +1,40 @@
+package de.towerdefence.server.server.channels.connection;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import de.towerdefence.server.player.Player;
+import de.towerdefence.server.server.JsonWebsocketHandler;
+import de.towerdefence.server.server.channels.connection.in.RequestConnectionTokenMessage;
+import de.towerdefence.server.server.channels.connection.out.ProvidedConnectionTokenMessage;
+import de.towerdefence.server.session.Channel;
+import de.towerdefence.server.session.SessionsService;
+import org.springframework.web.socket.CloseStatus;
+import org.springframework.web.socket.TextMessage;
+import org.springframework.web.socket.WebSocketSession;
+
+public class ConnectionWebsocketHandler extends JsonWebsocketHandler {
+    private final ObjectMapper objectMapper = new ObjectMapper();
+
+    public ConnectionWebsocketHandler(SessionsService sessionsService) {
+        super(Channel.CONNECTION, sessionsService);
+    }
+
+    @Override
+    protected void handleTextMessage(WebSocketSession session, TextMessage message) {
+        try{
+            String payload = message.getPayload();
+            switch ( objectMapper.readTree(payload).get("$id").asText()) {
+                case RequestConnectionTokenMessage.MESSAGE_ID -> handleRequestConnectionToken(session, payload);
+                default -> this.closeSession(session, CloseStatus.BAD_DATA);
+            }
+        } catch (Exception ignored) {
+            this.closeSession(session, CloseStatus.BAD_DATA);
+        }
+    }
+
+    private void handleRequestConnectionToken(WebSocketSession session, String payload) throws Exception {
+        RequestConnectionTokenMessage msg = objectMapper.readValue(payload, RequestConnectionTokenMessage.class);
+        Player player = this.sessionPlayers.get(session);
+        String jwt = this.sessionsService.createSession(player, msg.getChannel());
+        new ProvidedConnectionTokenMessage(msg.getChannel(), jwt).send(session);
+    }
+}

src/main/java/de/towerdefence/server/server/channels/connection/in/RequestConnectionTokenMessage.java

@@ -0,0 +1,16 @@
+package de.towerdefence.server.server.channels.connection.in;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import de.towerdefence.server.session.Channel;
+import jakarta.validation.constraints.NotNull;
+import lombok.*;
+
+@Data
+@NotNull
+public class RequestConnectionTokenMessage {
+    public static final String MESSAGE_ID = "RequestConnectionToken";
+
+    @JsonProperty("$id")
+    private String messageId;
+    private Channel channel;
+}

src/main/java/de/towerdefence/server/server/channels/connection/out/ProvidedConnectionTokenMessage.java

@@ -0,0 +1,28 @@
+package de.towerdefence.server.server.channels.connection.out;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import de.towerdefence.server.server.JsonMessage;
+import de.towerdefence.server.session.Channel;
+import lombok.AllArgsConstructor;
+
+import java.util.Map;
+
+@AllArgsConstructor
+public class ProvidedConnectionTokenMessage extends JsonMessage {
+    private final Channel channel;
+    private final String token;
+
+    @Override
+    protected String getMessageId() {
+        return "ProvidedConnectionTokenMessage";
+    }
+
+    @Override
+    protected Map<String, JsonNode> getData(JsonNodeFactory factory) {
+        return Map.of(
+                "channel", factory.textNode(channel.getJsonName()),
+                "token", factory.textNode(token)
+        );
+    }
+}

src/main/java/de/towerdefence/server/server/channels/time/TimeMessage.java

@@ -0,0 +1,23 @@
+package de.towerdefence.server.server.channels.time;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.JsonNodeFactory;
+import de.towerdefence.server.server.JsonMessage;
+import lombok.AllArgsConstructor;
+
+import java.util.Map;
+
+@AllArgsConstructor
+public class TimeMessage extends JsonMessage {
+    private final long time;
+
+    @Override
+    protected String getMessageId() {
+        return "CurrentUnixTime";
+    }
+
+    @Override
+    protected Map<String, JsonNode> getData(JsonNodeFactory factory) {
+        return Map.of("time", factory.numberNode(this.time));
+    }
+}

src/main/java/de/towerdefence/server/server/channels/time/TimeWebsocketConfig.java

@@ -0,0 +1,24 @@
+package de.towerdefence.server.server.channels.time;
+
+import de.towerdefence.server.session.SessionsService;
+import lombok.AllArgsConstructor;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.socket.config.annotation.EnableWebSocket;
+import org.springframework.web.socket.config.annotation.WebSocketConfigurer;
+import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry;
+
+@AllArgsConstructor
+@Configuration
+@EnableWebSocket
+public class TimeWebsocketConfig implements WebSocketConfigurer {
+    @Autowired
+    private final SessionsService sessionsService;
+    @Override
+    public void registerWebSocketHandlers(WebSocketHandlerRegistry registry) {
+        registry.addHandler(
+                new TimeWebsocketHandler(this.sessionsService),
+                "/ws/time"
+        ).setAllowedOrigins("*");
+    }
+}

src/main/java/de/towerdefence/server/server/channels/time/TimeWebsocketHandler.java

@@ -1,19 +1,27 @@
-package de.towerdefence.server.server;
+package de.towerdefence.server.server.channels.time;
 
-import org.springframework.web.socket.TextMessage;
+import de.towerdefence.server.server.JsonWebsocketHandler;
+import de.towerdefence.server.session.Channel;
+import de.towerdefence.server.session.SessionsService;
 import org.springframework.web.socket.WebSocketSession;
-import org.springframework.web.socket.handler.TextWebSocketHandler;
 
 import java.io.IOException;
 import java.util.Map;
 import java.util.concurrent.*;
 
-public class ServerWebsocketHandler extends TextWebSocketHandler {
-    private static final ScheduledExecutorService scheduler = Executors.newScheduledThreadPool(1);
+public class TimeWebsocketHandler extends JsonWebsocketHandler {
+
     private final Map<WebSocketSession, ScheduledFuture<?>> sessionTaskMap = new ConcurrentHashMap<>();
+    private static final ScheduledExecutorService scheduler = Executors.newScheduledThreadPool(1);
+
+    public TimeWebsocketHandler(SessionsService sessionsService) {
+        super(Channel.TIME, sessionsService);
+    }
 
     @Override
-    public void afterConnectionEstablished(WebSocketSession session) throws Exception {
+    public void afterConnectionEstablished(WebSocketSession session) {
+        super.afterConnectionEstablished(session);
+
         ScheduledFuture<?> scheduledTask = scheduler.scheduleAtFixedRate(
                 () -> sendCurrentTime(session),
                 0,
@@ -23,25 +31,16 @@ public class ServerWebsocketHandler extends TextWebSocketHandler {
         sessionTaskMap.put(session, scheduledTask);
     }
 
-    @Override
-    public void handleTextMessage(WebSocketSession session, TextMessage message) {
-        try {
-            String responseMessage = "You are Connected to the Tower Defence Server Websocket";
-            session.sendMessage(new TextMessage(responseMessage));
-        } catch (Exception e) {
-            e.printStackTrace();
-        }
-    }
-
     private void sendCurrentTime(WebSocketSession session) {
         ScheduledFuture<?> task = sessionTaskMap.get(session);
         try {
-            session.sendMessage(new TextMessage(String.valueOf(System.currentTimeMillis())));
-        } catch (IllegalStateException | IOException e) {
+            if(!session.isOpen()){
+                throw new RuntimeException("Session is not open");
+            }
+            new TimeMessage(System.currentTimeMillis()).send(session);
+        } catch (RuntimeException | IOException e) {
             task.cancel(true);
             sessionTaskMap.remove(session);
-        } catch (Exception e) {
-            e.printStackTrace();
         }
     }
 }

src/main/java/de/towerdefence/server/session/Channel.java

@@ -0,0 +1,24 @@
+package de.towerdefence.server.session;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+
+@Getter
+@AllArgsConstructor
+public enum Channel {
+    CONNECTION("connection"),
+    TIME("time");
+
+    private final String jsonName;
+
+    @JsonCreator
+    public static Channel fromJsonName(String jsonName) {
+        for (Channel channel : Channel.values()) {
+            if (channel.getJsonName().equalsIgnoreCase(jsonName)) {
+                return channel;
+            }
+        }
+        throw new IllegalArgumentException("Unknown channel: " + jsonName);
+    }
+}

src/main/java/de/towerdefence/server/session/JwtService.java

@@ -0,0 +1,61 @@
+package de.towerdefence.server.session;
+
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.security.Keys;
+import io.jsonwebtoken.security.WeakKeyException;
+import jakarta.annotation.PostConstruct;
+import org.springframework.stereotype.Service;
+
+import javax.crypto.SecretKey;
+import java.nio.charset.StandardCharsets;
+import java.util.Date;
+import java.util.Optional;
+
+@Service
+public class JwtService {
+
+    private final SecretKey secretKey;
+
+    public JwtService(JwtServiceConfig config) throws WeakKeyException {
+        this.secretKey = Keys.hmacShaKeyFor(config.getSecret().getBytes(StandardCharsets.UTF_8));
+    }
+
+    public String generateToken(String username, Channel channel, long ttl) {
+        long now = System.currentTimeMillis();
+        Date issueDate = new Date(now);
+        Date expirationDate = new Date(now + ttl * 1000);
+
+        return Jwts.builder()
+                .subject(username)
+                .claim("channel", channel.getJsonName())
+                .issuedAt(issueDate)
+                .expiration(expirationDate)
+                .signWith(secretKey)
+                .compact();
+    }
+
+    public Optional<String> verifyToken(String token, Channel channel) {
+        Claims claims = Jwts.parser()
+                .verifyWith(secretKey)
+                .build()
+                .parseSignedClaims(token)
+                .getPayload();
+
+        if (claims.getExpiration().before(new Date())) {
+            return Optional.empty();
+        }
+
+        Channel tokenChannel;
+        try {
+            tokenChannel = Channel.fromJsonName(claims.get("channel", String.class));
+        } catch (IllegalArgumentException ignored) {
+            return Optional.empty();
+        }
+        if(!channel.equals(tokenChannel)) {
+            return Optional.empty();
+        }
+
+        return Optional.of(claims.getSubject());
+    }
+}

src/main/java/de/towerdefence/server/session/JwtServiceConfig.java

@@ -0,0 +1,14 @@
+package de.towerdefence.server.session;
+
+import lombok.Getter;
+import lombok.Setter;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Getter
+@Setter
+@Configuration
+@ConfigurationProperties(prefix = "jwt")
+public class JwtServiceConfig {
+    private String secret;
+}

src/main/java/de/towerdefence/server/session/SessionsService.java

@@ -0,0 +1,63 @@
+package de.towerdefence.server.session;
+
+import de.towerdefence.server.player.Player;
+import lombok.AllArgsConstructor;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.concurrent.*;
+
+@Service
+@AllArgsConstructor
+public class SessionsService {
+    private static final int TIME_TO_LIVE_SECONDS = 30;
+
+    private final Map<String, Channel> tokenGrants = new ConcurrentHashMap<>();
+    private final Map<String, Player> sessions = new ConcurrentHashMap<>();
+    private final Map<String, ScheduledFuture<?>> tokenGarbageCollectors = new ConcurrentHashMap<>();
+
+    @Autowired
+    private final JwtService jwtService;
+    private static final ScheduledExecutorService scheduler = Executors.newScheduledThreadPool(1);
+
+    public String createSession(Player player, Channel channel){
+        String jwt = jwtService.generateToken(player.getUsername(), channel, TIME_TO_LIVE_SECONDS);
+        if(tokenGrants.containsKey(jwt)){
+            throw new IllegalStateException("The exact same JWT allready exists");
+        }
+        tokenGrants.put(jwt, channel);
+        sessions.put(jwt, player);
+        this.tokenGarbageCollectors.put(jwt, scheduler.schedule(() -> {
+            tokenGrants.remove(jwt);
+            sessions.remove(jwt);
+            tokenGarbageCollectors.remove(jwt);
+        }, TIME_TO_LIVE_SECONDS, TimeUnit.SECONDS));
+        return jwt;
+    }
+
+    public Optional<Player> getSession(String jwt, Channel channel){
+        Channel grantedChannel = tokenGrants.get(jwt);
+        if (grantedChannel == null || !grantedChannel.equals(channel)) {
+            return Optional.empty();
+        }
+        Optional<String> username = jwtService.verifyToken(jwt, channel);
+        if (username.isEmpty()) {
+            return Optional.empty();
+        }
+        Player player = sessions.get(jwt);
+        if (!Objects.equals(player.getUsername(), username.get())) {
+            return Optional.empty();
+        }
+        ScheduledFuture<?> garbageCollector = tokenGarbageCollectors.get(jwt);
+        if (garbageCollector != null && !garbageCollector.isCancelled() && !garbageCollector.isDone()) {
+            garbageCollector.cancel(false);
+        }
+        tokenGarbageCollectors.remove(jwt);
+        tokenGrants.remove(jwt);
+        sessions.remove(jwt);
+        return Optional.of(player);
+    }
+}

src/main/resources/application.properties

@@ -9,8 +9,11 @@ spring.datasource.username=${TD_DB_USER:td_user}
 spring.datasource.password=${TD_DB_PASS:td123}
 spring.jpa.hibernate.ddl-auto=create-drop
 
+# Signing JWT
+jwt.secret=i-am-secret-key-that-you-wont-guess
+
 # TODO: Replace with our own IAM (After completion of the project)
-# JWT Auth
+# JWT Auth for Keycloak
 spring.security.oauth2.client.registration.keycloak.client-id=employee-management-service
 spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization_code
 spring.security.oauth2.client.registration.keycloak.scope=openid

src/main/resources/spotbugs-exclude.xml

@@ -2,11 +2,16 @@
     xmlns="https://raw.githubusercontent.com/spotbugs/spotbugs/4.8.6/spotbugs/etc/findbugsfilter.xsd">
     <Match>
         <Source name="~.*" />
-        <Bug code="EI,EI2" /> <!-- We don't care about these codes -->
+        <Bug code="EI,EI2,UuF" /> <!-- We don't care about these codes -->
     </Match>
     <Match>
         <!--Ignore
         Auto Generated Code -->
         <Source name="~.*build/.*" />
     </Match>
+    <Match>
+        <!-- We are not Vulnerable to that Attack in our Context-->
+        <Class name="de.towerdefence.server.session.JwtService"/>
+        <Bug code="M,B,CT"/>
+    </Match>
 </FindBugsFilter>

src/test/java/de/towerdefence/server/IntegrationTest.java

@@ -2,7 +2,6 @@ package de.towerdefence.server;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import de.towerdefence.server.player.PlayerRepository;
-import de.towerdefence.server.player.PlayerService;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.springframework.beans.factory.annotation.Autowired;

ws/example/time_channel.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+response=$(curl -s -X 'POST' \
+  'http://localhost:8080/api/v1/player/login' \
+  -H 'accept: application/json' \
+  -H 'Content-Type: application/json' \
+  -d '{
+  "username": "Player1",
+  "password": "1234"
+}')
+
+token=$(echo "$response" | jq -r .token)
+payload='{"$id": "RequestConnectionToken", "channel": "time"}'
+response=$(echo "$payload" | websocat ws://localhost:8080/ws/connection -H "Authorization: $token")
+
+time_token=$(echo "$response" | jq -r .token)
+websocat ws://localhost:8080/ws/time -H "Authorization: $time_token"

ws/ws.yml

@@ -0,0 +1,126 @@
+asyncapi: 3.0.0
+info:
+  title: Game Server
+  version: 0.0.1
+  description: |
+    This is the Websocket Specification for the Tower Defence Game. <br>
+    Because of the limitations of Async API, we expect that the actual json,
+    which is send as payload to always contain a field called `$id` with 
+    the corresponding `messageId`. <br>
+    The `messageId` should be handled case sensitive.
+defaultContentType: application/json
+servers:
+  localhost:
+    host: localhost:8080
+    protocol: ws
+    pathname: /ws
+    security:
+      - $ref: "#/components/securitySchemes/JwtAuth"
+
+channels:
+  connection:
+    title: Connection
+    description: |
+      The Base Channel used for:
+      - Authentication
+      - Receiving Tokens for other channels
+      - Reconnection
+    messages:
+      RequestConnectionToken:
+        description: |
+          A Message telling the Server, that
+          you want an Connection Token for a
+          Specific Channel
+        payload:
+          type: object
+          additionalProperties: false
+          properties:
+            $id:
+              type: string
+              format: messageId
+            channel:
+              type: string
+              enum:
+                - time
+          required:
+            - $id
+            - channel
+      ProvidedConnectionToken:
+        description: |
+          A Message telling the Server, that
+          you want an Connection Token for a
+          Specific Channel
+        payload:
+          type: object
+          additionalProperties: false
+          properties:
+            $id:
+              type: string
+              format: messageId
+            channel:
+              type: string
+              enum:
+                - time
+            token:
+              $ref: "#/components/schemas/JWT"
+          required:
+            - $id
+            - channel
+            - token
+  time:
+    title: Time
+    description: |
+      A Simple example channel for receiving
+      the current Unix time
+    messages:
+      CurrentUnixTime:
+        description: The Current time in Unix Time
+        payload:
+          type: object
+          additionalProperties: false
+          properties:
+            $id:
+              type: string
+              format: messageId
+            time:
+              type: integer
+              format: int64
+          required:
+            - $id
+            - time
+
+operations:
+  requestConnectionToken:
+    title: RequestConnectionToken
+    action: send
+    channel:
+      $ref: "#/channels/connection"
+    messages:
+      - $ref: "#/channels/connection/messages/RequestConnectionToken"
+    reply:
+      channel:
+        $ref: "#/channels/connection"
+      messages:
+        - $ref: "#/channels/connection/messages/ProvidedConnectionToken"
+  updateTime:
+    title: Updates of the current Unix Time
+    action: receive
+    channel:
+      $ref: "#/channels/time"
+    messages:
+      - $ref: "#/channels/time/messages/CurrentUnixTime"
+
+components:
+  securitySchemes:
+    JwtAuth:
+      name: Authorization
+      description: |
+        A JWT Token has to be provided in the Handshake Header. <br>
+        This Field is expected to be called `Authorization`. <br>
+        It is expected to not have a prefix like `bearer`.
+      type: httpApiKey
+      in: header
+  schemas:
+    JWT:
+      type: string
+      format: jwt