Jwt lookup from multiple sources (#1845)

* Jwt lookup from multiple sources

middleware/jwt.go

@@ -160,17 +160,24 @@ func JWTWithConfig(config JWTConfig) echo.MiddlewareFunc {
 	}
 
 	// Initialize
-	parts := strings.Split(config.TokenLookup, ":")
+	// Split sources
-	extractor := jwtFromHeader(parts[1], config.AuthScheme)
+	sources := strings.Split(config.TokenLookup, ",")
-	switch parts[0] {
+	var extractors []jwtExtractor
-	case "query":
+	for _, source := range sources {
-		extractor = jwtFromQuery(parts[1])
+		parts := strings.Split(source, ":")
-	case "param":
+
-		extractor = jwtFromParam(parts[1])
+		switch parts[0] {
-	case "cookie":
+		case "query":
-		extractor = jwtFromCookie(parts[1])
+			extractors = append(extractors, jwtFromQuery(parts[1]))
-	case "form":
+		case "param":
-		extractor = jwtFromForm(parts[1])
+			extractors = append(extractors, jwtFromParam(parts[1]))
+		case "cookie":
+			extractors = append(extractors, jwtFromCookie(parts[1]))
+		case "form":
+			extractors = append(extractors, jwtFromForm(parts[1]))
+		case "header":
+			extractors = append(extractors, jwtFromHeader(parts[1], config.AuthScheme))
+		}
 	}
 
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
@@ -182,8 +189,17 @@ func JWTWithConfig(config JWTConfig) echo.MiddlewareFunc {
 			if config.BeforeFunc != nil {
 				config.BeforeFunc(c)
 			}
-
+			var auth string
-			auth, err := extractor(c)
+			var err error
+			for _, extractor := range extractors {
+				// Extract token from extractor, if it's not fail break the loop and
+				// set auth
+				auth, err = extractor(c)
+				if err == nil {
+					break
+				}
+			}
+			// If none of extractor has a token, handle error
 			if err != nil {
 				if config.ErrorHandler != nil {
 					return config.ErrorHandler(err)
@@ -194,6 +210,7 @@ func JWTWithConfig(config JWTConfig) echo.MiddlewareFunc {
 				}
 				return err
 			}
+
 			token := new(jwt.Token)
 			// Issue #647, #656
 			if _, ok := config.Claims.(jwt.MapClaims); ok {

middleware/jwt_test.go

@@ -179,6 +179,14 @@ func TestJWT(t *testing.T) {
 			hdrCookie: "jwt=" + token,
 			info:      "Valid cookie method",
 		},
+		{
+			config: JWTConfig{
+				SigningKey:  validKey,
+				TokenLookup: "query:jwt,cookie:jwt",
+			},
+			hdrCookie: "jwt=" + token,
+			info:      "Multiple jwt lookuop",
+		},
 		{
 			config: JWTConfig{
 				SigningKey:  validKey,