Question

我抛出了这个错误

com.auth0.jwt.exceptions.SignatureVerificationException：使用算法验证时令牌的签名无效：HmacSHA256

private static String SECRET = "some secret...";

public static DecodedJWT verify(String token) throws JWTVerificationException, UnsupportedEncodingException {
    JWTVerifier verifier = JWT.require(Algorithm.HMAC256(SECRET))
            .withIssuer("auth0")
            .acceptLeeway(1)
            .acceptExpiresAt(5 * 60)
            .build();

    return verifier.verify(token);
}

这个秘密是否存在问题，在网站jwt.io上我点击64编码的秘密基地然后变成蓝色。

我尝试使用https://www.base64encode.net在base 64中编码我的秘密但问题相同。请指教。

Answer 1

javadoc表示您需要提供原始密码值。这意味着您需要base64 - 解码您当前拥有的值：

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTVerificationException;
import com.auth0.jwt.interfaces.DecodedJWT;

import java.io.UnsupportedEncodingException;
import java.util.Base64;

public class JwtVerification {

    private static final String SECRET = "zZrq0sZK1yt9RJk51RTJ/jeU6WERbvr8nqKMWQJRX1E=";

    public static DecodedJWT verify(String token) throws JWTVerificationException, UnsupportedEncodingException {
        JWTVerifier verifier = JWT.require(Algorithm.HMAC256(Base64.getDecoder().decode(SECRET)))
                .withIssuer("auth0")
                .acceptLeeway(1)
                .acceptExpiresAt(5 * 60)
                .build();

        return verifier.verify(token);
    }

    public static void main(String[] args) throws UnsupportedEncodingException {
        final String token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0aWQiOiJiZWJlMjM4Zi1iMGM4LTQwYzMtOTYyMC1jZDRlOGUyMzIwZGMiLCJvaWQiOiI5MjJjMmZiNC0zNWI1LTExZDctOWE2NC0wMGIwZDBmY2I5ZTMiLCJzdWIiOiI5MjJjMmZiNC0zNWI1LTExZDctOWE2NC0wMGIwZDBmY2I5ZTMiLCJlbWFpbCI6InRlc3RAdGVzdC5jb20iLCJpYXQiOjE1MTg0NDk5NzYsImV4cCI6MTUxODQ1MzU3NiwibmJmIjoxNTE4NDQ5OTc2fQ.6InknrU67g_HEkaLxD9Ul5vOzbYGf54mJNcSyPr-xek";
        System.out.println(verify(token));
    }
}

我目前得到此异常，但它似乎是令牌本身的问题：

Exception in thread "main" com.auth0.jwt.exceptions.InvalidClaimException: The Claim 'iss' value doesn't match the required one.
    at com.auth0.jwt.JWTVerifier.assertValidStringClaim(JWTVerifier.java:424)
    at com.auth0.jwt.JWTVerifier.verifyClaims(JWTVerifier.java:382)
    at com.auth0.jwt.JWTVerifier.verify(JWTVerifier.java:355)
    at com.swiftkey.parametron.data.JWT2.verify(JWT2.java:23)
    at com.swiftkey.parametron.data.JWT2.main(JWT2.java:28)

实际上，令牌未指定iss字段，但由于.withIssuer("auth0")，验证者希望它为“auth0”。

如果您查看令牌：

        final String token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0aWQiOiJiZWJlMjM4Zi1iMGM4LTQwYzMtOTYyMC1jZDRlOGUyMzIwZGMiLCJvaWQiOiI5MjJjMmZiNC0zNWI1LTExZDctOWE2NC0wMGIwZDBmY2I5ZTMiLCJzdWIiOiI5MjJjMmZiNC0zNWI1LTExZDctOWE2NC0wMGIwZDBmY2I5ZTMiLCJlbWFpbCI6InRlc3RAdGVzdC5jb20iLCJpYXQiOjE1MTg0NDk5NzYsImV4cCI6MTUxODQ1MzU3NiwibmJmIjoxNTE4NDQ5OTc2fQ.6InknrU67g_HEkaLxD9Ul5vOzbYGf54mJNcSyPr-xek";
        final DecodedJWT decodedJwt = JWT.decode(token);
        System.out.println("Header =  " + decodedJwt.getHeader());
        System.out.println("Algorithm =  " + decodedJwt.getAlgorithm());
        System.out.println("Audience =  " + decodedJwt.getAudience());
        decodedJwt.getClaims().forEach((k, v) -> {
            System.out.println("Claim " + k + " = " + v.asString());
        });
        System.out.println("ContentType =  " + decodedJwt.getContentType());
        System.out.println("ExpiresAt =  " + decodedJwt.getExpiresAt());
        System.out.println("Id =  " + decodedJwt.getId());
        System.out.println("Issuer =  " + decodedJwt.getIssuer());
        System.out.println("Subject =  " + decodedJwt.getSubject());

您会看到Issuer字段为null

Header =  eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9
Algorithm =  HS256
Audience =  null
Claim sub = 922c2fb4-35b5-11d7-9a64-00b0d0fcb9e3
Claim nbf = null
Claim oid = 922c2fb4-35b5-11d7-9a64-00b0d0fcb9e3
Claim exp = null
Claim iat = null
Claim tid = bebe238f-b0c8-40c3-9620-cd4e8e2320dc
Claim email = test@test.com
ContentType =  null
ExpiresAt =  Mon Feb 12 16:39:36 GMT 2018
Id =  null
Issuer =  null
Subject =  922c2fb4-35b5-11d7-9a64-00b0d0fcb9e3

生成该令牌的人未指定Issuer（aka iss）字段。因此验证失败，因为我们将验证程序设置为期望iss等于auth0。

Answer 2

issuer-field 通常是一个类似 url 的值。如果您的应用程序的 auth0-domain 是 yourcompany.eu.auth0.com，则颁发者很可能是 https://yourcompany.eu.auth0.com/

尝试改变

    .withIssuer("auth0")

到

    .withIssuer("https://yourcompany.eu.auth0.com/")

在创建验证器时。

令牌签名无效错误

2 个答案: