dvsekhvalnov / jose-jwt

Ultimate Javascript Object Signing and Encryption (JOSE), JSON Web Token (JWT) and Json Web Keys (JWK) Implementation for .NET and .NET Core
MIT License
936 stars 184 forks source link

Creating symmetric key to match the JWT generated by .Net core #200

Open ramkithepower opened 2 years ago

ramkithepower commented 2 years ago

The third party API I am working with is asking me to generate the JWT on client side. I understand that they use the following code to verify JWT.


using System;
using System.Text;
using Microsoft.IdentityModel.Tokens;
using Microsoft.AspNetCore.Builder;

// The key length needs to be of sufficient length, or otherwise an error will occur.
var tokenSecretKey = Encoding.UTF8.GetBytes(Configuration["TokenSecretKey"]);

var tokenValidationParameters = new TokenValidationParameters
{
    // Token signature will be verified using a private key.
    ValidateIssuerSigningKey = true,
    IssuerSigningKey = new SymmetricSecurityKey(tokenSecretKey),
    ValidateIssuer = false,
    ValidateAudience = false
};

services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        }).AddJwtBearer(options => { options.RequireHttpsMetaData = false;
options.SaveToken = true; 
 options.TokenValidationParameters = tokenValidationParameters; 
});

In the client side the token generation I have created is as follows using Jose JWT. return Jose.JWT.Encode(claims, byteArrayOfKey, Jose.JwsAlgorithm.HS256);

but the validation is failing with 401 on server side. Is there anything I can do match the server side.

dvsekhvalnov commented 2 years ago

Hey @ramkithepower , that's hard to guess without additional details.

May be key mismatch, maybe they don't like something in your claims (aud, iss, dates), make be clock skew between client and server.

Try to get some logs.