Skip to content

token signature verification fails for ECDSA and jwks starting with java 15 #520

@meraedit

Description

@meraedit

The JWT token is not verified when using the key from jwks in the latest java version (or >=15.0.2), but it worked with older java versions (11, 13, 14).

Reproduction

Please run the attached java code jwt verification.zip
You need to serve the atached keys.json and update the url in the java sample.
When using an older java version (up to 14.0.2) it verifies the token using the key from the provided jwks.

When using java 17, it throws
Exception in thread "main" com.auth0.jwt.exceptions.SignatureVerificationException: The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA
at com.auth0.jwt.algorithms.ECDSAAlgorithm.verify(ECDSAAlgorithm.java:52)
at com.auth0.jwt.JWTVerifier.verify(JWTVerifier.java:299)
at com.auth0.jwt.JWTVerifier.verify(JWTVerifier.java:283)
at com.servoy.extensions.plugins.jwt.client.TestJWKS.verifyToken(TestJWKS.java:129)
at com.servoy.extensions.plugins.jwt.client.TestJWKS.main(TestJWKS.java:121)

Environment Windows 64-bit

  • Version of this library used: 3.18.1
  • Version of Java used: 17.0.1 (fails starting with java version 15.0.2)
  • Other modules/plugins/libraries that might be involved: jwks-rsa-java
  • Any other relevant information you think would be useful:
    Verifying the token is successful with any java version I tried (from java 11 to java 17) when providing the public key (not via jwks), as demonstrated in the attached sample.
    The public key obtained from jwks looks the same in any java version I tried, therefore I suspect that the issue is related to the token verification part and not to the public key.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugThis points to a verified bug in the codeneeds investigationAn issue that has more questions to answer or otherwise needs work to fully understand the issue

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions