Private key should not be required to verify JWT

[anuragkapur]

As per the following code sample in the documentation in the readme https://github.com/auth0/java-jwt/tree/b4c1eca4c68d68a343428c8bef4ce90774a4e29d#verify-a-token both private and public key is needed to verify a JWT's signature. This seems incorrect as when using RSA256 algorithm, there should be no need for the private key to verify the JWT.

String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXUyJ9.eyJpc3MiOiJhdXRoMCJ9.AbIJTDMFc7yUa5MhvcP03nJPyCPzZtQcGEp-zWfOkEE";
RSAPublicKey publicKey = //Get the key instance
RSAPrivateKey privateKey = //Get the key instance
try {
    Algorithm algorithm = Algorithm.RSA256(publicKey, privateKey);
    JWTVerifier verifier = JWT.require(algorithm)
        .withIssuer("auth0")
        .build(); //Reusable verifier instance
    DecodedJWT jwt = verifier.verify(token);
} catch (JWTVerificationException exception){
    //Invalid signature/claims
}

This alternate java library: https://github.com/jwtk/jjwt#reading-a-jws shows how the JWT is verified without secret key. Additionally, the Auth0 JWT node.js lib https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback also doesn't need private key when using RSA256.

[lbalmaceda]

We added a clarification for that right in the section above which explains the usage of the Algorithm class (used both for signing and verifying tokens). https://github.com/auth0/java-jwt/tree/b4c1eca4c68d68a343428c8bef4ce90774a4e29d#pick-the-algorithm

When using RSA or ECDSA algorithms and you just need to sign JWTs you can avoid specifying a Public Key by passing a null value. The same can be done with the Private Key when you just need to verify JWTs.

What is your suggestion?

[anuragkapur]

My sincere apologies. I did not read the section of the documentation that already clarifies this.

[hoto]

Sorry for resurrecting, should I create another issue?

We added a clarification for that right in the section above which explains the usage of the Algorithm class

That clarification is quite far away from the code sample 😬

I can do a PR but I wonder if there is any scenario where the RSAPrivateKey would NOT be null when verifying the token?
I wonder if the readme could be updated to pass RSAPrivateKey as null or put another short explanation in the comment?

[petrdvorak]

@hoto Best... visualization... ever... 😄 I opened auth0/java-jwt#555 to address this, the docs also stroke me visually and no, there is no situation when private key is required during the JWT verification.