Skip to content

bug: jwt-auth 500 error with not HS256 algorithm #2325

Description

@tanjiancheng

Issue description

call curl http://127.0.0.1:9080/apisix/plugin/jwt/sign?key=user-key -i
and then 500 Internal Server Error

Environment

  • apisix version (cmd: apisix version): both 1.2 and 1.5
  • OS: linux

Minimal test code / Steps to reproduce the issue

curl http://127.0.0.1:9080/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
    "username": "jack",
    "plugins": {
        "jwt-auth": {
            "key": "user-key",
            "algorithm": "HS384",
            "secret": "my-secret-key"
        }
    }
}'

result:

{"node":{"value":{"username":"jack","plugins":{"jwt-auth":{"algorithm":"HS384","key":"user-key","secret":"my-secret-key","exp":86400}}},"createdIndex":50,"key":"\/apisix\/consumers\/jack","modifiedIndex":50},"prevNode":{"value":"{\"username\":\"jack\",\"plugins\":{\"jwt-auth\":{\"algorithm\":\"HS256\",\"secret\":\"my-secret-key\",\"key\":\"user-key\",\"exp\":86400}}}","createdIndex":49,"key":"\/apisix\/consumers\/jack","modifiedIndex":49},"action":"set"}

curl http://127.0.0.1:9080/apisix/plugin/jwt/sign?key=user-key -i

result:

HTTP/1.1 500 Internal Server Error
Date: Sat, 26 Sep 2020 03:17:13 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 174
Connection: close
Server: APISIX web server

<html>
<head><title>500 Internal Server Error</title></head>
<body>
<center><h1>500 Internal Server Error</h1></center>
<hr><center>openresty</center>
</body>
</html>

check apisix error.log

2020/09/26 03:23:41 [error] 48#48: *11759 lua entry thread aborted: runtime error: unknown reason
stack traceback:
coroutine 0:
        [C]: in function 'error'
        /usr/local/apisix//deps/share/lua/5.1/resty/jwt.lua:505: in function 'sign'
        /usr/local/apisix/apisix/plugins/jwt-auth.lua:206: in function 'handler'
        /usr/local/apisix/apisix/plugin.lua:209: in function 'handler'
        /usr/local/apisix//deps/share/lua/5.1/resty/radixtree.lua:739: in function 'dispatch'
        /usr/local/apisix/apisix/http/router/radixtree_uri.lua:110: in function 'match'
        /usr/local/apisix/apisix/init.lua:336: in function 'http_access_phase'
        access_by_lua(nginx.conf:167):2: in main chunk, client: 172.18.0.1, server: , request: "GET /apisix/plugin/jwt/sign?key=user-key HTTP/1.1", host: "127.0.0.1:9080"

is this a bug?I use https://github.com/apache/apisix-docker/example to make the test env

Metadata

Metadata

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions