JWT::DecodeError

[nhosoya]

JWT::DecodeError

[anthony-bazhuhin]

the jwt_options portion provides access to the key fetched from apple using the JWK arguments described here: https://github.com/jwt/ruby-jwt#json-web-key-jwk

It was introduced in jwt (2.2.0). Using jwt < 2.2.0 results in
JWT::DecodeError No verification key available

Also looks like jwt 2.2.0 is not compatible with openssl 1.1.0. So doesn't work in ruby 2.3.x and older:
rvm/rvm#3862 (comment)

[ebsbk]

Had the same problem with omniauth-apple (1.0.0) and jwt (2.1.0). Upgrading jwt to 2.2.3 solved the issue

[vilius]

Thanks @ebsbk - I can confirm this. Same problem with omniauth-apple (1.0.2) and jwt (2.1.0). Upgrading jwt to 2.3.0 solved the issue.

[NdaJunior]

The issue seems to be coming from line 71 in apple.rb:

payload, _header = ::JWT.decode(id_token, nil, true, jwt_options)

JWT.decode is being called with the second parameter being nil. This nil value is what triggers the exeption

[btalbot]

the jwt_options portion provides access to the key fetched from apple using the JWK arguments described here: https://github.com/jwt/ruby-jwt#json-web-key-jwk

The nil second argument is not used (and must be nil) for this use case.

[NdaJunior]

@btalbot Thank you for your input. Do you know how I can resolve this issue ?

[NdaJunior]

@btalbot I downgraded to 0.0.3 and it works now

[btalbot]

omniauth-apple 0.0.3 doesn't really work and token validation is broken so it's not secure.

I would need an id-token from you that is not working along with the client_id value you're using in the omniauth-apple config. The apple issued id-tokens contain an email address so if you're concerned about that leaking, send a token using their @privaterelay.appleid.com service.