0
@Test
    public void testJwtBuilder() {
        JwtBuilder jwtBuilder = Jwts.builder()
                .setId("123456")
                .setSubject("Snake")
                .setIssuedAt(new Date())
                .signWith(SignatureAlgorithm.HS256, "123456789");

        String token = jwtBuilder.compact();
        System.out.println(token);

        for (String s : token.split("\\.")) {
            System.out.println(Base64Codec.BASE64.decodeToString(s));
        }
    }

This is the token I generated: eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIxMjM0NTYiLCJzdWIiOiJTbmFrZSIsImlhdCI6MTYyNjg4NTMwMH0.R0WmOmXaH93DiY_On98p7wSmKMsYpQN4a0T8-b82-bA

I set secret to "123456789",but I can parse it with "123456789x" or "12345678".

Here is my parsing code:

@Test
    public void parseToken() {
        String token = "eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIxMjM0NTYiLCJzdWIiOiJTbmFrZSIsImlhdCI6MTYyNjg4NTMwMH0.R0WmOmXaH93DiY_On98p7wSmKMsYpQN4a0T8-b82-bA";

        Claims claims = Jwts.parser()
                .setSigningKey("123456789x")
                .parseClaimsJws(token)
                .getBody();
        System.out.println(claims);
    }

Why does this happen?

hollow-latte
  • 1
  • Could you add a bit more information to your question? I've read it a couple of times and I'm unsure what you're trying to achieve – P. Brew Jul 22 '21 at 09:30
  • **unable to reproduce.** The 'key' you show is much too small to represent a valid HS256 key, and jjwt correctly refuses to produce any token at all. If I use a longer, valid string, and vary it in the ways you show, parse(verify) does throw as expected. But if I _change_ the last character of the key string -- NOT add or delete but change, and only to certain values depending on the correct value -- jjwt's lax base64 decoding does accept that as a different encoding of the _same_ key and in that case only parse(verify) does succeed. ... – dave_thompson_085 Jul 22 '21 at 12:14
  • ... This is explained on the [readme page](https://github.com/jwtk/jjwt/#base64-changing-characters) which is one of the first places a programmer should look. – dave_thompson_085 Jul 22 '21 at 12:17

0 Answers0