JWT validation is failing : Key bytes cannot be specified for RSA signatures. Please specify a PublicKey or PrivateKey instance

Question

I am trying to decode and verify JWT token in my service using the following code:

String  jwtSecret= "my_key";
Claims claims = Jwts.parser()
        .setSigningKey(jwtSecret)
        .parseClaimsJws(jwt).getBody();
return claims;

The above code does not work and throws the following exception:

java.lang.IllegalArgumentException: Key bytes cannot be specified for RSA signatures.  Please specify a PublicKey or PrivateKey instance.

I have tried creating Public key also but it didn't work. Can anyone state what I am missing?

Token is issued by other service which validates user generates the token. — Sonali, Jun 11 '20 at 13:10
You mean the token is beared through another service. But who's the Authorisation Server that issued the token initially? — tmarwen, Jun 11 '20 at 13:17
yes. It is through another service. Actually my service is a handling websockets so at time of handshake I am getting token in path param and trying to validate token — Sonali, Jun 11 '20 at 13:25

score 0 · Answer 1 · answered Jun 11 '20 at 20:32

Looks like you are JJWT for trying to decode the JWT. Where are you getting the public key from?

Instead of passing in the public key as a string, you should build a PublicKey first, then pass that in. If you have access to the exponent and modulus of the key:

BigInteger modulus = new BigInteger(1, Base64.getUrlDecoder().decode(key.getN()));

BigInteger exponent = new BigInteger(1, Base64.getUrlDecoder().decode(key.getE()));

RSAPublicKeySpec publicSpec = new RSAPublicKeySpec(modulus, exponent);
KeyFactory factory = KeyFactory.getInstance("RSA");
return factory.generatePublic(publicSpec);

If you don't, this post explains how you can build it from a string, but you have ensure that the string is formatted correctly.

In case you are interested, here is a more detailed post that I wrote on how to validate and parse a JWT signed by an Authorization server using JJWT.

score 0 · Accepted Answer · answered Jun 15 '20 at 07:21

Key I was using was not correct. I came to know when I tried generating the token with the key I was using and decoded with my same above code and same key , it worked. So I checked with the team which was handling the JWT token generation I found key was different.

JWT validation is failing : Key bytes cannot be specified for RSA signatures. Please specify a PublicKey or PrivateKey instance

2 Answers2