Signing a JWT?

Hey @fireproofsocks it’s a private key. Here is code I wrote to validate JWT keys against google firebase pem. You can probably refactor it to grab pems from somewhere else.

First, I had a genserver which, on boot, would fetch the keys from Google and put them in ets:

def request_keys(_) do
    url = keys_url()

    {:ok, 200, headers, body} = :hackney.request(:get, url, [], "", [:with_body])

    {_, cache_control} =
      Enum.find(headers, fn {k, _} ->
        String.downcase(k) == "cache-control"
      end)

    [_, expire_in] = Regex.run(~r/max\-age\=([0-9]*),/, cache_control)
    expire_in = String.to_integer(expire_in)

    body
    |> Jason.decode!()
    |> Map.values()
    |> Enum.map(&JOSE.JWK.from_pem/1)
    |> Enum.map(fn key ->
      %{type: :firebase, key: key, expire_in: expire_in * 1000}
    end)
  end

  defp keys_url() do
    "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com"
  end

That’s the fetching and parsing code, the ets and refresh based on expires in is left as an exercise to the reader.

In any case once that’s in place, when a request comes in with a JWT key you can verify it via:

def verify(token) do
    [{:keys, keys}] = :ets.lookup(Maven.Accounts.Auth, :keys)

    Enum.find_value(keys, &do_verify(&1, token))
  end

  defp do_verify(key_data, token) do
    case JOSE.JWT.verify(key_data.key, token) do
      {true, %{fields: fields}, _} ->
        {:ok, key_data.type, fields}

      _ ->
        nil
    end
  end

I wrote a JWT adapter that might be interesting to you: assent/lib/assent/jwt_adapter/assent_jwt.ex at 78e75769296fbe4f4383795e1ec6327d63fda60e · pow-auth/assent · GitHub

Here’s the test with public key example (I just hard code the keys): assent/test/assent/jwt_adapter/assent_jwt_test.exs at 78e75769296fbe4f4383795e1ec6327d63fda60e · pow-auth/assent · GitHub

Though I would recommend that you just rely on JOSE to handle it similar to the above example by @benwilson512.

Thanks @benwilson512 – this is a clean example of how to verify keys, cleaner than what I had worked out. However, I was looking for how to sign the key. @danschultzer – I think AssentJWT.sign/3 does exactly what I want. Thank you!

I’ve been having similar issues, trying to sign something just using JOSE.JWT.sign/3.

It seemed that using File.read/1 and then JOSE.JWK.from_pem/1 was giving different results to JOSE.JWK.from_pem_file/1. Unfortunately, the documentation for JOSE is really sparse, so I never worked out exactly why.

Is anybody still on here?

am I not able to verify a JWT by public.pem with the limited resources online…

I really need help

Thanks in advance.

Best wishes,
Jing Hui P.

Hi @enkr1, please provide samples of the code you are running, and the resources you’ve tried to follow. We can’t help if you don’t show us what you’ve tried so far.

Thank you @benwilson512 for taking the time to reply to my question!!

Here is how i did it:

return_token = "eyJhb...."

case File.read("./public.pem") do
  {:ok, public_key} ->
    {_, %{"n" => n} = key_map} =
      JOSE.JWK.from_pem(public_key)
      # |> IO.inspect(label: "orignal")
      |> JOSE.JWK.to_map()
      # |> IO.inspect(label: "mapified")

    signer =
      Joken.Signer.create("RS256", key_map)
      |> IO.inspect(label: "signer")

    Joken.Signer.verify(return_token, signer)
    |> IO.inspect(label: "verify") # Here is the part where it gives error

  {:error, unsupported_case} ->
    unsupported_case |> IO.inspect(label: "i didnt expect this.")
    {:erorr, "Something went wrong while trying to read the public.pem ..."}
end

output:

# ...

signer: %Joken.Signer{
  jwk: %JOSE.JWK{
    keys: :undefined,
    kty: {:jose_jwk_kty_rsa,
     {:RSAPublicKey,
 2374353...43,
      65537}},
    fields: %{}
  },
  jws: %JOSE.JWS{
    alg: {:jose_jws_alg_rsa_pkcs1_v1_5, :RS256},
    b64: :undefined,
    fields: %{"typ" => "JWT"}
  },
  alg: "RS256"
}

verify: {:error, :signature_error}
# ...

I was about to create a post and saw your reply.. thank you ma mannnnn

Best,
Jing Hui P.

I also tried this guy’s solution Using Joken to validate Google JWTs - #12 by vinagrito1

but what i am getting is false instead of true:

{false,
 %JOSE.JWT{
   fields: %{
      # ...
   }
 },
 %JOSE.JWS{
   alg: {:jose_jws_alg_rsa_pkcs1_v1_5, :RS256},
   b64: :undefined,
   fields: %{"typ" => "JWT"}
 }}

I have just created a new thread: How to verify RS256 JWT with Joken.Signer.verify/2 - 2022