A JSON Web Key is a JSON data structure that represents a cryptographic key.
A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key.
The specification for this structure is in RFC 7517.
Questions tagged [jwk]
218 questions
1
vote
1 answer
Creating jwks endpoint spring boot
I am building a two service app in Java Spring Boot where one service is an auth service that generates a jwt and the other one is a resource service, that decodes the jwt and returns list of posts based on the jwt subject.
My current auth service…
Kris
- 562
- 5
- 17
1
vote
1 answer
JWKS key info not found at well-known endpoint
My Spring Boot app is attempting to use Auth0 to validate a JWT it receives. My problem is the JWKS endpoint I have to connect to provides all of key information at the root of the URL, versus the well-known endpoint. My code snippet looks like…
CNDyson
- 1,687
- 7
- 28
- 63
1
vote
0 answers
JWK not found in Quarkus
I am trying to see if I can substitute an old service with a new one that uses Quarkus.
Todo so I need to be able to check some properties of the JWT that are sent with the request Authorization as a bearer token.
My problem is that after going over…
fditz
- 871
- 9
- 28
1
vote
1 answer
Validate and parse Auth0 JWT token in python
When someone logs in on my website through Auth0, I get a JWT token from Auth0. This token tells me the UID of the person and allows me to make API calls from the frontend to the backend where I can validate the JWT token to make sure the request…
Quantitative
- 51
- 2
- 6
1
vote
1 answer
Which Key Do We Use When Verifying Google ID Tokens
We're verifying a Google ID Token on ColdFusion servers. We have everything working but one thing puzzles me:
In the instructions here Google says to use their public keys to verify the token. When we retrieve the keys, in the JSON object there…
CFMLBread
- 734
- 3
- 7
1
vote
0 answers
invalid keycloak jwt token signature
private void verifySignature(DecodedJWT decodedJWT)
{
JsonObject payloadAsJson = decodeTokenPayloadToJsonObject(decodedJWT);
String iss=payloadAsJson.get("iss").getAsString();
System.out.println("iss"+iss);
JwkProvider provider =…
nitanshu sharma
- 11
- 2
1
vote
1 answer
Containerized Nginx Plus is Unable to Open or Rename Okta JWK File
Why is my instance of Nginx Plus unable to access a JSON Web Key (JWK) file from Okta?
This instance of Nginx Plus was containerized with a Dockerfile similar to this official Dockerfile.alpine direct from Nginx, with the following differences:
. .…
Mike
- 1,080
- 1
- 9
- 25
1
vote
1 answer
How can I overwrite the automatically calculated kid when importing a JWK from PEM
I am trying to create a JWE Token using the node-jose library's createEncrypt method. The problem is, I want to set the kid to a certain value. But when importing the key using the jose.JWK.asKey method, it's automatically calculating the kid and…
GAURAV KUMAR JHA
- 190
- 1
- 11
1
vote
0 answers
Envoy JWT Authentication fails with JSON Web Key Set as inline string
I want to try out Envoy JWT authentication with a local JSON Web Key Set as an inline string. As an algorithm I want to use HS256, because the key is only needed for my Service that generates the JWT and Envoy for enforcing rules, so not much…
JonasLevin
- 1,592
- 1
- 20
- 50
1
vote
1 answer
How to create key from JWK key for verifying COSE signature-1 with Python?
I am working on a python script to verify New Zealand Vaccination passports. I struggle at the point where I have the government's certificate and and the decoded COSE message and need to try to verify its signature:
key_as_dict = {
KpKty:…
hey
- 2,643
- 7
- 29
- 50
1
vote
1 answer
Why does encrypting a JWT with AES_128_CBC_HMAC_SHA_256 also change its "alg" header parameter?
I am creating symmetrically signed Tokens with HMAC + SHA-256. As expected the header looks like this:
{
"alg": "HS256",
"typ": "JWT"
}
But when I encrypt the token with the AES_128_CBC_HMAC_SHA_256, the header changed to this:
{
"alg":…
Beltway
- 508
- 4
- 17
1
vote
0 answers
Failing to create JWT with JWK signature
I am trying to create JWT with KID, alg=RS256, TypeError: Expecting a PEM-formatted key.
import json
import jwt
from cryptography.hazmat.backends.openssl import rsa
from cryptography.hazmat.primitives import serialization
body={
"sub":…
SKK
- 31
- 1
- 6
1
vote
1 answer
Why EC key is treated as a valid RSA key for the JWT and JWK?
I've recently been working on implementing a web service that signs and issues JWT and also exposes the JWKs endpoint for the JWT validation purposes.
It's all fairly straightforward with the JWT / JWK according to the IETF spec, but I noticed…
Dmitry Kankalovich
- 553
- 2
- 8
- 19
1
vote
1 answer
Can "kid" in JWKS be just string of numbers, and what is the maximum number of characters kid can hold?
I am trying to validate the JWKS stored in the resource server. One of the checks I have implemented is to check for the kid that I decode from the JWT and check for it in the configured resource server.
I went through the JWK RFC for "kid". In the…
Q2Dev
- 85
- 1
- 9
1
vote
0 answers
Verifying Hydra-generated JWT access_token signature in jwt.io?
I configured Hydra to return JWT in access_token (STRATEGIES_ACCESS_TOKEN=jwt). Pasting the resulting token[1] in jwt.io works—it's decoded successfully and the data looks right. Now I want to verify the signature.
So I open…
wiradikusuma
- 1,930
- 4
- 28
- 44