It is not possible to get the claims and the JWT parameters without verify about fusionauth-jwt HOT 6 CLOSED

See commit 4e5d4d0, added JWTUtils. decodePayload - will this work for you?

from fusionauth-jwt.

Hi @Ostico

I think you're asking for how to decode the JWT w/out validation?

In addition to your example code, you can also use this method:

String accessToken = authResult.getAccessToken();
JWT jwt = JWT.getDecoder().decode(accessToken);

This is using the varargs version of the decode method.

public JWT decode(String encodedJWT, Verifier... verifiers)

Using this method, when 0 verifiers are provided, we will allow you to decode the JWT w/out verification. This way we know for sure the caller is asking us to decode the JWT w/out signature verification.

Let me know if I haven't answered your question.

from fusionauth-jwt.

Hi @robotdan , i already tried without verifiers, but i get an exception:
io.fusionauth.jwt.MissingVerifierException: No Verifier has been provided for verify a signature signed using [SHA256withRSA]

From the code it seems that is not possible decode a JWT when parts.lenght != 2:

even if allowNoneAlgorithm is true:

private JWT validate(String encodedJWT, String[] parts, Header header, Verifier verifier, boolean allowNoneAlgorithm) {
...
}

from fusionauth-jwt.

Ah, ok, I see what you mean. Yeah, you're correct, we don't offer a way to decode the JWT w/out verification (at least not easily).

Would it help if I added a utility method to decode the payload? Would you also want the header?

For example, something like :

String accessToken = authResult.getAccessToken();
JWT jwt = JWTUtils.decodePayload(accessToken);

This method would not perform any validation, it would only read the JSON and return a JWT object.

This would more/less do the same thing you're doing already:

byte[] payload = Base64.getUrlDecoder().decode( authResult.getAccessToken().split( "\\." )[ 1 ] );
JWT jwt = Mapper.deserialize( payload, JWT.class );

from fusionauth-jwt.

Yes, it is perfect. The header is not so important in my opinion.
Thank you.

from fusionauth-jwt.

Great, thanks for the feedback. I also added JWTUtils.decodeHeader if that is of use.
Released and available in version 3.0.2.

from fusionauth-jwt.