I don't understand why my token signature is deemed invalid

[tomasaschan]

I'm trying to get refresh token flow working in my application, but I've run into a problem where the token I get back from Azure AD does not validate. There's a more complete write-up on StackOverflow and a gist with a runnable code sample, but in short, the verification code looks like this:

const getKey = (header, callback) => {
  client.getSigningKey(header.kid, (err, key) => {
    if (err) {
      callback(err)
    } else {
      var signingKey = key.publicKey || key.rsaPublicKey
      callback(null, signingKey)
    }
  })
}

const verifyToken = token => new Promise((resolve, reject) => {
  jwt.verify(token, getKey, { maxAge: "1h" }, (err, decoded) => {
    if (err) {
      console.log('token verification failed:', err.message)
      reject(err)
    } else {
      resolve(decoded)
    }
  })
})

and when I get a token through the authorization code flow, everything works as expected, but when I refresh the token using the refresh token flow, the new token is deemed to have an invalid signature - even though it's perfectly possible to use the new token for communicating with Azure.

What should I look for here?

[JacoKoster]

@tlycken I see that the StackOverflow-question has been resolved. Is that correct?

[tomasaschan]

@JacoKoster Yes, it has - thanks. It seems I was using the 2.0 endpoint to get the keys, but the 1.0 endpoint to get the tokens. I was able to resolve my immediate issue (getting a new access token that validates) by ensuring to use the 1.0 endpoint for keys as well.

However, I still don't understand why I got the results I did. If the metadata url I used was for the wrong version, why did it work at all before?

[ziluvatar]

I don't have knowledge about how Azure AD operates, it is a bit weird indeed, however, maybe the 2.0 endpoint uses symmetric algorithm for the signature and you are providing a key for an asymmetric signing which seems to be used by 1.0

All of this ^ are just thoughts without any investigation :P

I'm going to close the issue, just for curiosity, if you found the reason it'd be nice to read it :)