如何在 Flutter 应用程序中从 Azure 获取有效的 RS256 令牌？

Question

I'm doing a Flutter app for iOS and Android, and I need to use authentification to access to the main content.

For that I used this pubdev package (aad_oauth), and it works very well. I need to get the token provided by Azure to send it to my API to authenticate my user.

I used this method:

    var token = await oauth.getAccessToken();

But the token is considered invalid even by my API then by https://jwt.io/ with the error "invalid signature" but works in the Flutter app.

Here is a censored screen of jwt.io:

Did someone knows how to get a valid token to send it after?

Answer 1

The invalid signature thrown by jwt.io is well known. You will need to manually obtain and set the Azure AD signing certificate content. Follow the steps detailed in USING JWT.IO TO VERIFY THE SIGNATURE OF A JWT TOKEN.

Regarding validation at the API, you may have to fine-tune its token validation routine. This varies depending on the platform or library used for such end. you can find samples for Microsoft backed libraries here .

For more information on recommended validation please take a look to Validate tokens.