search

garyf / json_web_token

A Ruby implementation of the JSON Web Token (JWT) standard, RFC 7519
MIT License
60 stars 4 forks source link

Secure token example in README(s) is invalid #2

Closed grempe closed 8 years ago

grempe commented 8 years ago

The following token, part of your example code in the README (in both this repository and in the jwt_claims repo as well!), is invalid.

secure_jwt_example = 'eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt.cGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'

Tested with json_web_token gem:

[6] pry(main)> JsonWebToken.verify('eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt.cGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk', key: 'gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr9C')
=> {:error=>"invalid"}

Shows truncated payload output when tested in the https://jwt.io/ debugger and signature does not verify there.

grempe commented 8 years ago

Insecure token example in README also seems broken:

unsecured_jwt_example = 'eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt.'
[9] pry(main)> unsecured_jwt_example = 'eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt.'
=> "eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt."
[10] pry(main)> JsonWebToken.verify(unsecured_jwt_example, alg: 'none')
RuntimeError: Algorithm not matching 'alg' header parameter
from /usr/local/var/rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/json_web_token-0.3.1/lib/json_web_token/jws.rb:80:in `validate_alg_match'
[11] pry(main)>
grempe commented 8 years ago

I submitted a pull request with the fix in the jwt_claims gem for this README issue in that repo.

https://github.com/garyf/jwt_claims/pull/2/commits/e3357e1f104e5b387d5d9b39623f9f9aed5b7279