JWT parsed by jjwt-java but showing invalid in jwt.io debugger

Question

I am learning about JWS for authentication, and tried to implement using one of the java libraries jjwt. I created one JWT token string and added a single character to its end. To my surprise, jjwt library parsed it without throwing any exceptions. I don't know if there is any issue with the library or the algorithm used. I tested the same with jwt debugger and it is working as expected(showing invalid token).

CODE :

public class TestJwt {
    // private static final String JWT_SECRET_KEY = "qdsfkjbwfjn323rwefwdef3kewrwerv5236v56d56w1xweec3wdn3i432oi";          // WORKING !!!
    // private static final String JWT_SECRET_KEY = "qdsfkjbwfjn323rwefwdef3kewrwerv52f36v56d56w1xweec3wdn3i432oi";         // WORKING !!!
    // private static final String JWT_SECRET_KEY = "qdsfkjbwfjn323rwefwdef3kewrwerv52f36345345weec3wdn3i432oi";            // WORKING !!!
    // private static final String JWT_SECRET_KEY = "qdsfkjbwfjn323rwefwdef3kewrwerv52f36345432oi";                         // NOT WORKING
    // private static final String JWT_SECRET_KEY = "qdsfkjbwfjn323rwefwdef3kewrwerv52f3632222222245y6454524524tef45432oi"; // NOT WORKING
    
    private static final String JWT_SECRET_KEY = "qdsfkjbwfjn323rwefwdef3kewrwerv5236v56d56w1xweec3wdn3i432oi"; // WORKING
    private static final Key key = Keys.hmacShaKeyFor(JWT_SECRET_KEY.getBytes());
    

    public static void main(String args[]) {
        
        String token = 
        Jwts.builder()
        
        .claim("name", "RANDOM")
        .claim("surname", "ANOTHER_RANDOM")
    
        .signWith(key)
        .compact();
        
        System.out.println("TOKEN BEFORE");
        System.out.println(token);
        
        // Adding single character to jwt and still working!!
        token = token+"7";
        
        System.out.println("TOKEN AFTER");
        System.out.println(token);
        
        
        Claims claims = Jwts.parserBuilder()
                .setSigningKey(key).build()             
                .parseClaimsJws(token).getBody();
        
        claims.forEach((k,v)->{
            System.out.println("________________________");
            System.out.println(k + " : "+v);
            
        });
        
        System.out.println("________________________"); 
    }
}

OUTPUT :

TOKEN BEFORE
eyJhbGciOiJIUzM4NCJ9.eyJuYW1lIjoiUkFORE9NIiwic3VybmFtZSI6IkFOT1RIRVJfUkFORE9NIn0.evntuAcZ0Urnv-5QniShmENKNBSzrjoxeNWN0uW-sy-qXzC-G2PJyi316m9LqQH9
TOKEN AFTER
eyJhbGciOiJIUzM4NCJ9.eyJuYW1lIjoiUkFORE9NIiwic3VybmFtZSI6IkFOT1RIRVJfUkFORE9NIn0.evntuAcZ0Urnv-5QniShmENKNBSzrjoxeNWN0uW-sy-qXzC-G2PJyi316m9LqQH97
________________________
name : RANDOM
________________________
surname : ANOTHER_RANDOM
________________________

I was expecting a SignatureException. I have tested with few keys and random claims, some of them are working but some are parsing without an issue(commented out keys). Should I use more complex keys?

HMAC-SHA384 (JWS HS384) is 48 bytes which base64-encodes to 64 characters with no leftover bits. **Adding one base64 character to that size field leaves the decoded value the same, so it verifies.** If you add _two_ chars, or delete one char (from that size), or change any char (in that size; a different size field e.g. HS256 might ignore a change to the last char), it will change the decoded valuie and be detected. Similarly changing one char at the end of the payload (second dot-delimited part) might or might not affect the decoded value and thus might or might not be detected. — dave_thompson_085, Feb 07 '23 at 18:54
Effectively crossdupe https://crypto.stackexchange.com/questions/102363/is-it-secure-to-sign-a-jwt-using-rs256 though different in detail. See the diagrams in [wikipedia](https://en.wikipedia.org/wiki/Base64#Examples). — dave_thompson_085, Feb 07 '23 at 18:56

score 1 · Accepted Answer · answered Feb 07 '23 at 19:03

It's not a problem with the secret, but how the Base64Url decoder was implemented.

The original signature is 64 characters long, which in Base64Url encoding (6 bits per character) means, that there are 64 * 6 bits = 384 bits encoded. This is exactly as expected when you use the HS384 algorithm. And 384 bits/6 is exactly 64, so the signature can be encoded in a 64 character Base64Url string without any unused bits. Now when you add another character, it means that you add 6 bits. And the decoder in your Java code seems to just ignore these 6 bits, because it's not enough information for a complete byte. But technically it's an invalid Base64Url string and would require at least one more character. The decoder used on jwt.io seems to be stricter in this regard.

See also JWT token decoding even when the last character of the signature is changed which explains why you sometimes can change the last character of the signature without invalidating it.

JWT parsed by jjwt-java but showing invalid in jwt.io debugger

1 Answers1