Invalid JWToken: kid is a required JOSE Header

Question

I am trying to implement an Oauth2 Authorization Server with SpringBoot using this guide as a reference.

My keystore has a single key. I have successfully managed to create a JWToken (I can check it at jwt.io).

I have also a test Resource Server. When I try to access any endpoint I receive the following message:

{
  "error": "invalid_token",
  "error_description": "Invalid JWT/JWS: kid is a required JOSE Header"
}

The token really does not have a kid header but I can not figure out how to add it. I can only add data to its payload, using a TokenEnchancer. It also seems that I am not the first one with this issue.

Is there any way to add this header or, at least, ignore it at the resource server?

Answer 1

I managed to solve it by changing the parameter used to identify the URL where the clients will retrieve the pubkey.

On application.properties, instead of:

security.oauth2.resource.jwk.key-set-uri=http://{auth_server}/.well-known/jwks.json

I used:

security.oauth2.resource.jwt.key-uri=http://{auth_server}/oauth/token_key

If I understood correctly, the key-set-uri config points to an endpoint that presents a set of keys and there is the need for a kid. On the other side key-uri config points to an endpoint with a single key.