Java JWT decode alg is JWT_ALG_NONE

[benmcollins]

Java JWT decode alg is JWT_ALG_NONE

[benmcollins]

LibJWT expects an RSA PublicKey for verification, not a certificate. This may help:

https://knowledge.digicert.com/solution/SO21807.html

[xiao8385]

My mistake not describe clear.

We already get the public key, and use public key can decode the token at this site .
It shows "Signature Verified". and "alg": "RS256".

I list down the snapshot for jwt.io not sure if you can see.

The issue is when we use the public key to decode the token, we have to pass a parameter JWT_ALG_NONE then can successfully decode. And check the ALG value is 0. I'm not sure if this is valid cause the ALG should be RS256.

[benmcollins]

That is not a "Public Key" that is a Certificate (it says so in the file). Do this:

openssl x509 -pubkey -in yourcert.pem

Which will get you this public key:

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAknPGNQ2+zKdm/rCQQ8GW
264I73974dxZfu0B8rhqXdchPHHKVAxr4b+aphphB6Ht0mNEGAuaW/21hXB9lIOb
pcR9wMvTV6Bfuvf33Slqk6y2/hczblbEZ9q1O2xtfwoKJbGoL5cvQVtmJvvW2Wep
rQQrsSAmfCa/sGCSlGd98U05inVaaPpIfRegyeiA4mbdCPcKRZiRaHMKUACjgobO
lOItgTOGu2xUJtNnKbZpy1qwkCtcTHDKUmX0R5g7RHxyZ6aHxS979570fc0A0d3A
Xlr9hrJO4vo7kchvLk+4yVQN4JdUMXvtHlKhgQw1achU6q8jaatIXLTvSNkZIjTj
KQIDAQAB
-----END PUBLIC KEY-----

Use this with LibJWT to verify the JWT. This works on JWT.io and in LibJWT.

[xiao8385]

Ooh, you are right.
Thank you very much! :)