CODEWITHSUNDEEP
javajwtdigital-signature
ashishl
ashishl

Reputation: 203

JWT Token verification with Java

I am facing a issue that whenever I am signing a token also I parse it and it is not throwing any signature exception.

You can see the key are different still it giving me the proper response.

public class JwtUtil {

 public String parseToken(String token) {
    try {
       Jws<Claims> jwt = Jwts.parser()                  
                .setSigningKey("Test@12")                    
                .parseClaimsJws(token);


        System.out.println(jwt.getBody().getSubject());
        return "Valid";

    } catch (SignatureException jwtException) {
        jwtException.printStackTrace();
        return null;
     }
 }


public String generateToken() {

    Claims claim = Jwts.claims();
    claim.put("GivenName", "Johnny");
    claim.put("Surname", "Rocket");
    claim.put("Email", "[email protected]");      

    return Jwts.builder().setHeaderParam("typ", "JWT").setClaims(claim)
            .setIssuer("Online JWT Builder")
            .setAudience("www.example.com").setSubject("[email protected]")
            .signWith(SignatureAlgorithm.HS256, "Test@123").compact();


}

public static void main(String[] args) {
    JwtUtil jwtUtil = new JwtUtil();        
    String token = jwtUtil.generateToken();
    System.out.println(token);  

    JwtUtil jwtUtil1 = new JwtUtil();
    jwtUtil1.parseToken(token);
 }
}

Upvotes: 4

Views: 6481

Answers (1)

pedrofb
pedrofb

Reputation: 39311

Really Test@12 and Test@123 are the same key

It is due to JwtBuilder.signWith(SignatureAlgorithm alg, String base64EncodedSecretKey). assumes that you are providing a key in base64 and your keys are not base64. When the method decodes from base64 to byte[] the java converter used by jjwt provides a representation of the string. Test@12 and Test@123 are encoded with the byte array

See https://stackoverflow.com/a/38269014/6371459

You can test yourself with

System.out.println(
            javax.xml.bind.DatatypeConverter.printBase64Binary(
                    javax.xml.bind.DatatypeConverter.parseBase64Binary("Test@12")));
System.out.println(
            javax.xml.bind.DatatypeConverter.printBase64Binary(
                    javax.xml.bind.DatatypeConverter.parseBase64Binary("Test@123")));

Try a (more) different key and the SignatureException will be thrown

Upvotes: 2

Related Questions