davidgtonge / jwt Goto Github PK

Not sure if this project is active at all... was steered to it by someone well-versed in JWT's (in the context of OAuth). It's been quite useful in confirming various things as I've been learning OAuth. Thank you

I could have sworn the site was working fine 6 months or so ago; I just came back to it and am having an issue with using my jwks (url below)

• A Key not found error is displayed on the right side of the page
• There are no keys displayed on the left hand beneath the JWKS input field (your sample endpoints like accounts.google.com do displays the keys found),
• in the Network tab of the the Developers Tools window, it appears the proxy is returning a 404.
  However, I can access the jwks page it just fine from the address bar. This issue originated when my own app encountered something similar when I requested an access token ... I get a 400 from the server -- invalid request with a description of "JWS signature invalid", which could also be a result of the jwks not being accessed properly. I assumed it was my error, until I plugged the requesting token into your site and obtained the above results

The jwks in question is:
https://dev3.turingscraft.com/codelab/api/lti3/actions/jwks
however, I also looked up and found some other public jwks site, notably:
https://api.apps.cam.ac.uk/oauth2/v1/.well-known/jwks.json
and the same issue occurs ... i.e., no keys seem to be found (or at least that's your diagnostic -- though the same 404 occurs seemingly implying you're not getting the file whatsoever).

In case you ARE listening to this project still, and have any inclination to pursue this, I can also forward a sample token, though the 404 seems to preclude the issue being the contents of the token.

Hi there,

If you format a JWK in a slightly incorrect way, this tool will still count it as valid. I think this is fundamentally an issue with rsasignjs, so I submitted a bug report there. I even tried the latest version of that library and the issue was still there, so bumping version wouldn't help.

This caused some headaches for my company, which uses this tool for troubleshooting. The behavior of this doesn't tool line up with the software we use that validates JWTs we receive (Microsoft crypto libraries).