Our agent has a concept of 'untrusted payloads' this is to allow diagnostics and error

Fixed and releasing in 5.0.0. See example usage: <div class="Box Box--condensed my

Thanks <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-u

Embedding JWK does not yield an interoperable result about fusionauth-jwt HOT 3 CLOSED

fusionauth commented on May 26, 2024

Embedding JWK does not yield an interoperable result

from fusionauth-jwt.

Comments (3)

robotdan commented on May 26, 2024 3

Fixed and releasing in 5.0.0. See example usage:

fusionauth-jwt/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java

Line 124 in ce55851

public void embedded_jwk() {

from fusionauth-jwt.

robotdan commented on May 26, 2024 1

When we serialize the header, we are treating that field as a string, so it becomes JSON escaped.

For example:

{
  "alg" : "RS256",
  "typ" : "JWT",
  "cty" : "application/json",
  "jwk" : "{\"e\":\"AQAB\",\"kty\":\"RSA\",\"n\":\"Auchby3lZKHbiAZrTkJh79hJvgC3W7STSS4y6UZEhhxx3m3W2hD8qCyw6BEyrciPpwou-vmeDN7qBSk2QKqTTjlg5Pkf8O4z8d9HAlBTUDg4p98qLFOF2EFWWTiFbQwAP2qODOIv9WCAM2rkXEPwGiF962XAoOwiSmldeDu7Uo5A-bnTi0z3oNu4qm_48kv90o9CMiELszE9jsfoH32WE71HDqhsRjVNddDJ81e5zxBN8UEmaR-gmWqa63laON2KANPugJP7PrYJ_PC9ilQfV3F1rDpqbvlFQkshohJ39VrVpEtSRmJ12nqTFuspXLApekOyic3J9jo6ZI7o3IdQmy3bpnJIT_U\",\"use\":\"sig\"}"
}

But it looks like the spec for using the jwk claim in the header is just raw JSON. The header object currently assumes everything is a string, but this looks to be a bad assumption.

Here is what it should look like:

{
  "alg" : "RS256",
  "typ" : "JWT",
  "cty" : "application/json",
  "jwk" : {
    "e" : "AQAB",
    "kty" : "RSA",
    "n" : "Auchby3lZKHbiAZrTkJh79hJvgC3W7STSS4y6UZEhhxx3m3W2hD8qCyw6BEyrciPpwou-vmeDN7qBSk2QKqTTjlg5Pkf8O4z8d9HAlBTUDg4p98qLFOF2EFWWTiFbQwAP2qODOIv9WCAM2rkXEPwGiF962XAoOwiSmldeDu7Uo5A-bnTi0z3oNu4qm_48kv90o9CMiELszE9jsfoH32WE71HDqhsRjVNddDJ81e5zxBN8UEmaR-gmWqa63laON2KANPugJP7PrYJ_PC9ilQfV3F1rDpqbvlFQkshohJ39VrVpEtSRmJ12nqTFuspXLApekOyic3J9jo6ZI7o3IdQmy3bpnJIT_U",
    "use" : "sig"
  }
}

The change is easy, but this may be a breaking change. Let me think about how to best deliver this fix.

from fusionauth-jwt.