JWT validation with JWKS golang

Question

Im using dgrijalva/jwt-go & lestrrat-go/jwx. What im trying to achive is validate wso2 jwt using jwks.

the token(expired token):

const tokenStr = `eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImI2TnozUDJwMHg1QWpfWENsUmhrVDFzNlNIQSJ9.eyJodHRwOlwvXC93c28yLm9yZ1wvY2xhaW1zXC9hcHBsaWNhdGlvbnRpZXIiOiJVbmxpbWl0ZWQiLCJodHRwOlwvXC93c28yLm9yZ1wvY2xhaW1zXC9rZXl0eXBlIjoiUFJPRFVDVElPTiIsImh0dHA6XC9cL3dzbzIub3JnXC9jbGFpbXNcL3ZlcnNpb24iOiIxLjAiLCJpc3MiOiJ3c28yLm9yZ1wvcHJvZHVjdHNcL2FtIiwiaHR0cDpcL1wvd3NvMi5vcmdcL2NsYWltc1wvYXBwbGljYXRpb25uYW1lIjoiVGFseW9uIiwiaHR0cDpcL1wvd3NvMi5vcmdcL2NsYWltc1wvZW5kdXNlciI6IkZEQkBjYXJib24uc3VwZXIiLCJodHRwOlwvXC93c28yLm9yZ1wvY2xhaW1zXC9lbmR1c2VyVGVuYW50SWQiOiItMTIzNCIsImh0dHA6XC9cL3dzbzIub3JnXC9jbGFpbXNcL3N1YnNjcmliZXIiOiJGREIiLCJodHRwOlwvXC93c28yLm9yZ1wvY2xhaW1zXC90aWVyIjoiR29sZCIsImh0dHA6XC9cL3dzbzIub3JnXC9jbGFpbXNcL2FwcGxpY2F0aW9uaWQiOiIxNDU2IiwiaHR0cDpcL1wvd3NvMi5vcmdcL2NsYWltc1wvdXNlcnR5cGUiOiJBUFBMSUNBVElPTiIsImV4cCI6MTU4OTQ2NjI0MSwiaHR0cDpcL1wvd3NvMi5vcmdcL2NsYWltc1wvYXBpY29udGV4dCI6IlwvY3VycmVudC1hY2NvdW50XC9jaGVxdWVzXC9hdXRvbWF0aWMtZGVwb3NpdHNcL2F0bVwvMS4wIn0=.K1iPtdXiuicuDPaLC6Exw/7UpJVW6Uy1tPpJlfZ29Vqs9M1zR00JpKxvymQMAzbD0GHlXPPsZmhDxOn0WMAPfr1Xi8tiruTLXNbwUPJ/SOovt+zK4JGtrydhc4iv2EROhMUk2uwJUb4DFjqKZRhBvtCW7fRtdtI9yJL4W4OK8Ld90yOb97usPjEPz8S4E4uNrb5lE2rLzIp+EaPwA232lDkhS8gGPIKdlLG1IdEfQ4cFU1VIplvWoHzprF9mGR0ahT2QGgmGE3AcBfkURk8VzIKDG/UcBA9eHu3XGg28j3OvIXWwJhd7Hi+jTqvggi0hplao8ElvjNBw/wNy2UO9WA==`

the jwks:

{"keys":[{"kty":"RSA","e":"AQAB","use":"sig","kid":"MjhhMDk2N2M2NGEwMzgzYjk2OTI3YzdmMGVhOGYxNjI2OTc5Y2Y2MQ","alg":"RS256","n":"zZU9xSgK77PbtkjJgD2Vmmv6_QNe8B54eyOV0k5K2UwuSnhv9RyRA3aL7gDN-qkANemHw3H_4Tc5SKIMltVIYdWlOMW_2m3gDBOODjc1bE-WXEWX6nQkLAOkoFrGW3bgW8TFxfuwgZVTlb6cYkSyiwc5ueFV2xNqo96Qf7nm5E7KZ2QDTkSlNMdW-jIVHMKjuEsy_gtYMaEYrwk5N7VoiYwePaF3I0_g4G2tIrKTLb8DvHApsN1h-s7jMCQFBrY4vCf3RBlYULr4Nz7u8G2NL_L9vURSCU2V2A8rYRkoZoZwk3a3AyJiqeC4T_1rmb8XdrgeFHB5bzXZ7EI0TObhlw"}]}

most of the examples iv'e seen out there uses 'kid' and are not relevant because my token header doesn't have it, it has 'x5t' field..

and i must note one more thing it seems my signature is base64 encoded and not base64 url encoded (it pretty much messes the usage of Parse method). i have tried using jwt.Parse() i have tried manually encrypt header and payload sha256 and than RS256 and base64 but none showed success.

things i have tried:

const tokenString = `..`
func main() {
    t, err := jwt.Parse(tokenStr,  func(t *jwt.Token) (interface{}, error) {
        return []byte("b6Nz3P2p0x5Aj_XClRhkT1s6SHA"), nil
    })
}

Answer 1

As you might have already noticed, github.com/lestrrat-go/jwx only supports RawURLEncode base64 format. The best solution would be if you could use tokens in that particular format.

As a hacky workaround, you could manually re-encode your token to RawURLEncode format and feed that token to the jwt.ParseString() function:

// token consists of three parts (header, payload, signature) separeted by '.'
stdEncodedParts := strings.Split(tokenStr, ".")
var rawURLEncodedParts []string
for _, part := range stdEncodedParts {
    rawpart, err := base64.StdEncoding.DecodeString(part)
    if err != nil {
        panic(err)
    }
    rawURLEncodedParts = append(rawURLEncodedParts, base64.RawURLEncoding.EncodeToString(rawpart))
}

rawURLEncodedToken := strings.Join(rawURLEncodedParts, ".")
token, err := jwt.ParseString(rawURLEncodedToken)

As for the validation part, it would look something like the code below, although I did not manage to verify your token. Are you sure, you provided the proper verification key? Also note, that you might have to feed a custom fabricated token to jws.VerifyWithJWKSet(), because

1. it cannot parse the signature in the original StdEncoded format

2. but at the same time, the signature should have been made on the first half of the original, StdEncoded string thus you cannot provide the re-encoded string as it is.

const jwksStr = `{"keys":[{"kty":"RSA","e":"AQAB","use":"sig","kid":"MjhhMDk2N2M2NGEwMzgzYjk2OTI3YzdmMGVhOGYxNjI2OTc5Y2Y2MQ","alg":"RS256","n":"zZU9xSgK77PbtkjJgD2Vmmv6_QNe8B54eyOV0k5K2UwuSnhv9RyRA3aL7gDN-qkANemHw3H_4Tc5SKIMltVIYdWlOMW_2m3gDBOODjc1bE-WXEWX6nQkLAOkoFrGW3bgW8TFxfuwgZVTlb6cYkSyiwc5ueFV2xNqo96Qf7nm5E7KZ2QDTkSlNMdW-jIVHMKjuEsy_gtYMaEYrwk5N7VoiYwePaF3I0_g4G2tIrKTLb8DvHApsN1h-s7jMCQFBrY4vCf3RBlYULr4Nz7u8G2NL_L9vURSCU2V2A8rYRkoZoZwk3a3AyJiqeC4T_1rmb8XdrgeFHB5bzXZ7EI0TObhlw"}]}`
customTokenStr := stdEncodedParts[0] + "." + stdEncodedParts[1] + "." + rawURLEncodedParts[2]
jwks, err := jwk.ParseString(jwksStr)
if err != nil {
    panic(err)
}
_, err = jws.VerifyWithJWKSet([]byte(customTokenStr), jwks, nil)