[英]How to validate ES384 JWT signature with x and y coordinate in python
我有一個 JWT 如下:
Authorization: Bearer eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsImtpZCI6IjQ0ODIzZjNkLTBiMDEtNGE2Yy1hODBlLWI5ZDNlOGE3MjI2ZiIsImprdSI6Imh0dHBzOi8vc2FuZGJveC5jZHMtaG9va3Mub3JnLy53ZWxsLWtub3duL2p3a3MuanNvbiJ9.eyJpc3MiOiJodHRwczovL3NhbmRib3guY2RzLWhvb2tzLm9yZyIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9jZHMtc2VydmljZXMiLCJleHAiOjE1OTQyMzA5MDAsImlhdCI6MTU5NDIzMDYwMCwianRpIjoiZWZiMzc3M2QtM2EyOC00M2UyLTlmYmMtYjkzNmE5YWUzODhiIn0.Cbey3n5NkDRoCLHZ2WMFc1z_RY8Rlq5oGxdAYfbrBPMiJXLCwjbYoU0av2CQj-Olhbnpe7Vs8vzJ5oHP5gc2-0ooc5J49t4Uz9iYKpiM9KLUrqaJe0umc_klM2-ynHAI
I've been struggling since python libraries like PyJWT require a PEM format public key for Elliptical curve algorithms, and I'm having to decode the base64 to get the header which has the "jku" ( https://sandbox.cds-hooks .org/.well-known/jwks.json ),它只有 x 和 y 坐標,沒有公鑰。
我覺得我完全走錯了方向,因為我認為應該是一個簡單且自動化的過程,用於使用 ES384 alg 驗證 JWT。
如果有人可以幫助解釋如何使用庫/python 代碼來驗證這一點,那將是一個救命稻草!
您可以為此使用 Jose-JWT 庫:
pip install python-jose
使用 Jose-JWT,您可以從給定的 JWK 構造一個密鑰,也可以直接在decode
調用中使用 JWK ( JSON Web Key ),如下面的簡短示例所示:
from jose import jwk, jwt
es384_key = {
"kty": "EC",
"crv": "P-384",
"kid": "44823f3d-0b01-4a6c-a80e-b9d3e8a7226f",
"use": "sig",
"alg": "ES384",
"x": "dw_JGR8nB2I6XveNxUOl2qk699ZPLM2nYI5STSdiEl9avAkrm3CkfYMbrrjr8laB",
"y": "Sm3mLE-n1zYNla_aiE3cb3nZsL51RbC7ysw3q8aJLxGm-hx79RPMYpITDjp7kgzy"
}
allowed_aud = "http://127.0.0.1:8000/cds-services"
token = "eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsImtpZCI6IjQ0ODIzZjNkLTBiMDEtNGE2Yy1hODBlLWI5ZDNlOGE3MjI2ZiIsImprdSI6Imh0dHBzOi8vc2FuZGJveC5jZHMtaG9va3Mub3JnLy53ZWxsLWtub3duL2p3a3MuanNvbiJ9.eyJpc3MiOiJodHRwczovL3NhbmRib3guY2RzLWhvb2tzLm9yZyIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9jZHMtc2VydmljZXMiLCJleHAiOjE1OTQyMzA5MDAsImlhdCI6MTU5NDIzMDYwMCwianRpIjoiZWZiMzc3M2QtM2EyOC00M2UyLTlmYmMtYjkzNmE5YWUzODhiIn0.Cbey3n5NkDRoCLHZ2WMFc1z_RY8Rlq5oGxdAYfbrBPMiJXLCwjbYoU0av2CQj-Olhbnpe7Vs8vzJ5oHP5gc2-0ooc5J49t4Uz9iYKpiM9KLUrqaJe0umc_klM2-ynHAI"
payload = jwt.decode(
token,
es384_key,
audience = allowed_aud,
options = {'verify_exp':False})
print (payload)
盡管它被稱為decode
,但 function 實際上會驗證簽名。
注意:我添加了options = {'verify_exp':False}
以避免錯誤,因為您的令牌昨天已經過期。
Output:
{'iss': 'https://sandbox.cds-hooks.org', 'aud': 'http://127.0.0.1:8000/cds-services', 'exp': 1594230900, 'iat': 1594230600, 'jti': 'efb3773d-3a28-43e2-9fbc-b936a9ae388b'}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.