Closed dehy closed 1 year ago
I've just found that jwk_set_key
is an abstraction of the json file. Working as expected after setting a kid
The RFC specifies that kid
is optional (https://www.rfc-editor.org/rfc/rfc7517#section-4.5) Use of this member is OPTIONAL.
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days
@dehy how did you manage to use it without "kid"?
I figured out by doing this:
jwk = PyJWK(jwks_key)
jwt.decode(token, jwk.key, algorithms=["EdDSA"])
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days
The lib cannot get signing keys from the jwks.json file because it checks for json keys that does not exist in the RFC
Expected Result
It should find signing keys from a compliant jwks.json file
Actual Result
It raise an error.
Reproduction Steps
Here is a sample
jwks.json
fileThe check for valid keys is done on this line https://github.com/jpadilla/pyjwt/blob/9695f4c1d153ed8bf2b9ba0ef232c3a90889a1be/jwt/jwks_client.py#L77 Per the RFC 7517 or this doc from auth0, the parameters does not include neither
public_key_use
(butuse
norkey_id
(butkid
)System Information