Skip to content

Links with a public key in them no longer validate the JWS against the provided key #942

Description

@jogu

Links with a public key in them no longer load the key into the userinterface - e.g.

https://jwt.io/#debugger-io?token=eyJraWQiOiIyNTkzYzg0YzMyYzhlMzFlNDY2YjZlOGZiOGJjNzQ0MGE4MTU5MDFjYjFhNjU4NjkwM2Y1ZDIwOWRiODUyYjgyIiwiYWxnIjoiUFMyNTYifQ.eyJzdWIiOiJKZExrU1dHY2YwbWZIeE16Wk5vdEgiLCJhdWQiOiJodHRwczovL210bHMtYXMub3BlbmZpbmFuY2UtZGV2LnFpdGVjaC5hcHAvdG9rZW4iLCJuYmYiOjE3Nzc5Mzg0NTEsImlzcyI6IkpkTGtTV0djZjBtZkh4TXpaTm90SCIsImV4cCI6MTc3NzkzODUxMSwiaWF0IjoxNzc3OTM4NDUxLCJqdGkiOiJhMERyeFJNMHJZRVB1NDg4Y1lCNSJ9.AF-dA2khA6eKzWYD61emzXsAi_-EZ3iy-sIoDj6JB32iM1a89_7iljYFWQRohAWkxlkkQTD4zOVu-uy878M3BBKradLYeSjZ07izGsvJ3F9nz4EdRAkEsy00gOMMpvgi9dFUfNGGoeVMPX8o6ymc1epCqOZBSBleT7khHnYuL6TxYrPz4dPkTpPvNdxEc-1pMJx-60khjlBRdoz0ZPq3iDfKr4tEDKNIjUvoFsT0i7DFLnVlUTYp8lAnQGpTMyqJceRzG9oMfrfUwn73aIUVg4ccMJyNQTc0aYTVYEjHD1TN-YtbqPmXzjyA_35HV4fWACa3x7blCmnx3JuoHPXZog&publicKey=%7B%22kty%22%3A%22RSA%22%2C%22e%22%3A%22AQAB%22%2C%22use%22%3A%22sig%22%2C%22kid%22%3A%222593c84c32c8e31e466b6e8fb8bc7440a815901cb1a6586903f5d209db852b82%22%2C%22alg%22%3A%22PS256%22%2C%22n%22%3A%22vf-KwU0bhvI0XaBvLd3vs3GFRv2NA4GMfpjr-2wtNfNiTVedxhTJpC5vlG601k0CyS3zMjnfSVLorN-bXhiyWnYzK6ZDRkZn1tFriWPCu39gdHN7DWLQ_GtlacgsEQDyPf8vhHn8_Xj19ZAE08PPnFR51mVfNwkSpAQNAm0wjaTBL2FVBOHK_vcGZ-svlc8gXK-NfhGBZRP9agmWZs5qPwLV1fpPWsul38lU6S1KbE92aKT00O8DxNS8VdiEx9qJ6Msjy7cP8xOG-EfzFT9XGpZIHma_5M8OpgIfkhrJvkNCQz1-i-uwI2eMw-qppZgDJZ7a5wTOamOAVI0sdTrFCw%22%7D

It now shows an error instead:

Unable to retrieve public key from issuer (iss) 'JdLkSWGcf0mfHxMzZNotH'. Expected a valid HTTPS URL. Please enter public key manually to verify the JWT signature.

We were relying on this functionality in the OpenID Foundation's conformance suite ( https://gitlab.com/openid/conformance-suite - I'm the Director of Certification at OpenID Foundation) to show to users that an independent party could successfully validate a JWS we generated (before we added that we'd get many reports that the JWS we'd generated wasn't signed correctly).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions