search

awslabs / aws-jwt-verify

JS library for verifying JWTs signed by Amazon Cognito, and any OIDC-compatible IDP that signs JWTs with RS256, RS384, RS512, ES256, ES384, and ES512
Apache License 2.0
632 stars 45 forks source link

[BUG] `JwksNotAvailableInCacheError` when calling `verifySync()` #169

Closed ryanwalters closed 3 months ago

ryanwalters commented 3 months ago

Describe the bug I am attempting to verify an access token using the verifySync() function within a Next.js 14 app router application. However, I receive the following error:

JwksNotAvailableInCacheError: JWKS for uri https://cognito-idp.us-east-1.amazonaws.com/us-east-1_redacted/.well-known/jwks.json not yet available in cache
    at SimpleJwksCache.getCachedJwk (webpack-internal:///(rsc)/./node_modules/aws-jwt-verify/dist/esm/jwk.js:188:19)
    at CognitoJwtVerifier.verifyDecomposedJwtSync (webpack-internal:///(rsc)/./node_modules/aws-jwt-verify/dist/esm/jwt-rsa.js:258:36)
    at CognitoJwtVerifier.verifySync (webpack-internal:///(rsc)/./node_modules/aws-jwt-verify/dist/esm/cognito-verifier.js:102:14)
    at new CognitoClient (webpack-internal:///(rsc)/./src/utils/cognito-client/index.ts:71:48)
    at TestPage (webpack-internal:///(rsc)/./src/components/pages/TestPage/TestPage.tsx:21:20)
    at ex (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:270718)
    at e (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:274856)
    at eU (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:275344)
    at eV (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:281334)
    at eO (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:271546)
    at ex (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:270588)
    at e (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:274856)
    at eU (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:275344)
    at H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:272569
    at Array.toJSON (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:273033)
    at stringify (<anonymous>)
    at eV (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:281433)
    at eY (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:281951)
    at AsyncLocalStorage.run (node:async_hooks:346:14)
    at Timeout._onTimeout (H:\Project\node_modules\next\dist\compiled\next-server\app-page.runtime.dev.js:35:290253)
    at listOnTimeout (node:internal/timers:573:17)
    at process.processTimers (node:internal/timers:514:7)

Versions Which version of aws-jwt-verify are you using? 4.0.1 Are you using the library in Node.js or in the Web browser? Node.js If Node.js, which version of Node.js are you using? (Should be at least 16) v20.12.0 If Web browser, which web browser and which version of it are you using? If using TypeScript, which version of TypeScript are you using? (Should be at least 4) v5.3.3

To Reproduce

  1. Pull down repo: https://github.com/ryanwalters/aws-jwt-verify-bug
  2. npm install
  3. Set the following environment variables in .env:
    • NEXT_PUBLIC_CLIENT_ID
    • NEXT_PUBLIC_USER_POOL_ID
    • NEXT_PUBLIC_ACCESS_TOKEN (please make sure this is a valid access token for this test's purposes)
  4. npm run dev
  5. Navigate to http://localhost:3000

Expected Result The console logs the result of verifySync().

Actual Result Throws JwksNotAvailableInCacheError.

ottokruse commented 3 months ago

Hi mate. Did you load the JWKS into the cache first? That's required if you want to use 'verifySync'.

But it looks like you can make your Next code work by just switching to 'verify' (which is async and you need to await it). If you use 'verify' the fetching of the JWKS happens automatically (can't do that for 'verifySync' as it's, well, sync).

ottokruse commented 3 months ago

Also please check the main README, if you CTRL-F for verifySync you'll find more info on how this is intended to work.

ryanwalters commented 3 months ago

Thanks @ottokruse, I had missed that part of the readme. I had expected the sync functionality to work the same as async, without the need to manually load the jwks.json. I think we can close this one out for the time being, thanks!