- When using the serve command, a new `-m` flag allows for authenticated access to publications using a JWT in the route to the publication instead of the encoded path. The subject (`sub`) of the JWT will instead be used as the path to the publication. The first new mode is `jwt` mode, which uses the HS256 method of authentication and a shared secret that is either provided using `--jwt-shared-secret` or autogenerated at startup. The second mode, `jwks`, is combined with the `--jwks-url` flag that points to JWKS file, which can contain multiple keys used to validate the JWT, allowing for key rotation and other algorithms using public/private keypairs

- The path of a publication with no resource specified now redirects to the manifest file

- The GOAMD64 value for release builds has been changed from `v3` to `v2`. The discussion regarding this is [here](https://github.com/readium/cli/issues/78). This allows execution of the built binaries on older x64 CPUs

- The HTTP client configuration used for streaming of remote publications has been changed to require, at minimum, TLSv1.2 for HTTPS connections

- The serve command's routes are now prefixed with `/webpub`. So `<domain>/<path>/manifest.json` is now `<domain>/webpub/<path>/manifest.json`

- The `/list.json` route in the serve command's webserver has been removed. It is not compatible with the new authenticated access schemes, and was only intended to be temporary. It may be replaced in the future by an OPDS2 feed

github.com/MicahParks/jwkset v0.11.0

github.com/MicahParks/keyfunc/v3 v3.7.0

github.com/golang-jwt/jwt/v5 v5.2.2

github.com/MicahParks/jwkset v0.11.0 h1:yc0zG+jCvZpWgFDFmvs8/8jqqVBG9oyIbmBtmjOhoyQ=

github.com/MicahParks/jwkset v0.11.0/go.mod h1:U2oRhRaLgDCLjtpGL2GseNKGmZtLs/3O7p+OZaL5vo0=

github.com/MicahParks/keyfunc/v3 v3.7.0 h1:pdafUNyq+p3ZlvjJX1HWFP7MA3+cLpDtg69U3kITJGM=

github.com/MicahParks/keyfunc/v3 v3.7.0/go.mod h1:z66bkCviwqfg2YUp+Jcc/xRE9IXLcMq6DrgV/+Htru0=

github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=

github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=

"github.com/readium/cli/internal/version"

gv "github.com/readium/go-toolkit/pkg/util/version"

rootCmd.Version = version.Version + " (go-toolkit " + gv.Version + ")"

"crypto/rand"

"encoding/hex"

"github.com/readium/cli/pkg/serve/auth"

var mode string

var jwtSharedSecret string

var jwksURL string

Short: "Start a local HTTP server, serving publications locally or remotely",

Long: `Start a local HTTP server, serving publications locally or remotely.

access to publications and prevent abuse or unauthorized access.`,

var authProvider auth.AuthProvider

switch mode {

case "base64":

authProvider = auth.NewB64EncodedAuthProvider()

slog.Info("Operating in open access mode with base64url encoding (insecure)")

case "jwt":

var sharedSecret []byte

if jwtSharedSecret == "" {

// Auto-generate shared secret

var rawSecret [32]byte

_, err := rand.Reader.Read(rawSecret[:])

if err != nil {

return fmt.Errorf("failed to generate random shared secret: %w", err)

}

sharedSecret = rawSecret[:]

slog.Info("Operating in HS256 JWT access mode", "secret", hex.EncodeToString(sharedSecret))

} else {

sharedSecret, err = hex.DecodeString(jwtSharedSecret)

if err != nil {

return fmt.Errorf("failed to decode hex-encoded JWT shared secret: %w", err)

}

slog.Info("Operating in HS256 JWT access mode", "secret", "<jwt-shared-secret flag>")

}

authProvider, err = auth.NewJWTAuthProvider(sharedSecret)

if err != nil {

return fmt.Errorf("failed creating JWT auth provider: %w", err)

}

case "jwks":

if jwksURL == "" {

return fmt.Errorf("jwks-url must be specified in jwks mode")

}

slog.Info("Operating in JWKS JWT access mode", "jwks_url", jwksURL)

authProvider, err = auth.NewJWKSAuthProvider(context.Background(), remote.HTTP, jwksURL)

if err != nil {

return fmt.Errorf("failed creating JWKS auth provider: %w", err)

}

default:

return fmt.Errorf("invalid access mode %q, acceptable values: base64, jwt, jwks", mode)

}

Auth: authProvider,

WriteTimeout: 600 * time.Second, // 5 minutes for server to respond with resource

serveCmd.Flags().StringVarP(&mode, "mode", "m", "base64", "Access mode: base64 (default, base64url-encoded paths), jwt (JWT auth with a shared secret), jwks (JWT auth with keys in a JWKS)")

serveCmd.Flags().StringVar(&jwtSharedSecret, "jwt-shared-secret", "", "Hex-encoded shared secret used for HS256 JWT signature validation. If omitted, but JWT auth is enabled, the secret is auto-generated and logged (debug) at runtime")

serveCmd.Flags().StringVar(&jwksURL, "jwks-url", "", "URL to a JWKS (JSON Web Key Set) used for JWT signature validation when in 'jwks' mode")

package version

loc, err := url.URLFromString(filename)

filename := req.Context().Value(ContextPathKey).(string)

filename := r.Context().Value(ContextPathKey).(string)

if r.Method == http.MethodHead {

return

}

if r.Method == http.MethodHead {

headers()

return

}

if r.Method == http.MethodHead {

headers()

return

}

package auth

type AuthProvider interface {

Validate(token string) (string, int, error)

}

package auth

import (

"encoding/base64"

"fmt"

"net/http"

)

type B64EncodedAuthProvider struct{}

func (n *B64EncodedAuthProvider) Validate(token string) (string, int, error) {

path, err := base64.RawURLEncoding.DecodeString(token)

if err != nil {

return "", http.StatusBadRequest, fmt.Errorf("invalid base64url path: %w", err)

}

return string(path), http.StatusOK, nil

}

func NewB64EncodedAuthProvider() *B64EncodedAuthProvider {

return &B64EncodedAuthProvider{}

}