Node.js验证来自.net的jwt令牌失败

Question

I create token from .net by this C# code (with System.IdentityModel.Tokens.Jwt):

var keybytes = Convert.FromBase64String("MYCUSTOMCODELONGMOD4NEEDBEZE");
var signingCredentials = new SigningCredentials(

new InMemorySymmetricSecurityKey(keybytes),
SecurityAlgorithms.HmacSha256Signature,
SecurityAlgorithms.Sha256Digest);
var nbf = DateTime.UtcNow.AddDays(-100);
var exp = DateTime.UtcNow.AddDays(100);
var payload = new JwtPayload(null, "", new List<Claim>(), nbf, exp);
var user = new Dictionary<string, object>();
user.Add("userId", "1");

payload.Add("user", user);
payload.Add("success", true);
var jwtToken = new JwtSecurityToken(new JwtHeader(signingCredentials), payload);
var jwtTokenHandler = new JwtSecurityTokenHandler();
var resultToken = jwtTokenHandler.WriteToken(jwtToken);

I send the resultToken to nodejs and verify it (with jsonwebtoken library) with below code:

var jwt    = require('jsonwebtoken');

var result = jwt.verify(
  resultToken,
  new Buffer('MYCUSTOMCODELONGMOD4NEEDBEZE').toString('base64'),
  { algorithms: ['HS256'] },
  function(err, decoded) {
    if (err) {
    console.log('decode token failed with error: '+ JSON.stringify(err));
    }
  }
);

I got the error: invalid signature. The resultToken content:

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0OTQ4MTMxMTUsIm5iZiI6MTQ3NzUzMzExNSwidXNlciI6eyJ1c2VySWQiOiIxIn0sInN1Y2Nlc3MiOnRydWV9.4bjYyIUFMouz-ctFyxXkJ_QcJJQofCEFffUuazWFjGw

I have debug it on jwt.io with above signature ( MYCUSTOMCODELONGMOD4NEEDBEZE ) and secret base64 encoded checked, it's ok.

I have tried a signature without base64 encoded by chaging keybytes in C# code:

var keybytes = Encoding.UTF8.GetBytes("MYCUSTOMCODELONGMOD4NEEDBEZE");

And it verified successfully in nodejs. So i think the issue comes from my nodejs code when verify a base64 encoded signature. Did i miss some options when verify token or somethings?

Answer 1

I have no idea what you did but this snippet is working for me with the token you provided above.

var jwt = require('jwt-simple')

var secret = new Buffer('MYCUSTOMCODELONGMOD4NEEDBEZE').toString('base64')
var token = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0OTQ4MTMxMTUsIm5iZiI6MTQ3NzUzMzExNSwidXNlciI6eyJ1c2VySWQiOiIxIn0sInN1Y2Nlc3MiOnRydWV9.4bjYyIUFMouz-ctFyxXkJ_QcJJQofCEFffUuazWFjGw'

var decoded = jwt.decode(token, secret)
console.log(decoded)

Output:

❯ node jwt.js
{ exp: 1494813115,
  nbf: 1477533115,
  user: { userId: '1' },
  success: true }    

Using jsonwebtoken library

// var jwt = require('jwt-simple')

var jwt = require('jsonwebtoken');
var secret = Buffer.from('MYCUSTOMCODELONGMOD4NEEDBEZE', 'base64')
var token = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0OTQ4MTMxMTUsIm5iZiI6MTQ3NzUzMzExNSwidXNlciI6eyJ1c2VySWQiOiIxIn0sInN1Y2Nlc3MiOnRydWV9.4bjYyIUFMouz-ctFyxXkJ_QcJJQofCEFffUuazWFjGw'

jwt.verify(token, secret, { algorithms: ['HS256'] }, function(err, decoded) {
    if (err) {
        console.log(err)
    } else {
        console.log(decoded)    
    }  
})

Again still working fine.

The only difference i can see is the secret.