spring-security icon indicating copy to clipboard operation
spring-security copied to clipboard

Reactive JWT Decoder not picking up algo from jwk but non reactive version works

Open thomasmillergb opened this issue 3 years ago • 0 comments

Describe the bug ReactiveJwtDecoders.fromIssuerLocation("https://thomasmiller.eu.authz.cloudentity.io/thomasmiller/test") does not return the correct algo. As RS256 comes back instead of EC256 However Not reactive version does work and comes back with EC256 JwtDecoders.fromIssuerLocation("https://thomasmiller.eu.authz.cloudentity.io/thomasmiller/test")

Drilling into it ReactiveJwtDecoderProviderConfigurationUtils.getJWSAlgorithms() will return the right value if you block it. However its never ran, due to further up chain.

** Reproduce ** Create a JWT with EC256 Have JWK of EC256 `ReactiveJwtDecoders.fromIssuerLocation("jwk with just ec256")

// The access token is a test token with no access and is expired invalid 
    main(){
// Will throw ec256 not supported
ReactiveJwtDecoders
.fromIssuerLocation("https://thomasmiller.eu.authz.cloudentity.io/thomasmiller/test")
.decode("eyJhbGciOiJFUzI1NiIsImtpZCI6IjI1MzI4NzQzODA2OTQyMjcyNDI5OTE2MDUwMzE5OTE1MTM3NTAxNSIsInR5cCI6IkpXVCJ9.eyJhY3IiOiIxIiwiYWlkIjoidGVzdCIsImFtciI6WyJwd2QiXSwiYXVkIjpbImFiYWZjOTk0ZWM2MjQzMWFhZGE1YTBmNTc3YTM5ZTM4Iiwic3BpZmZlOi8vdGhvbWFzbWlsbGVyLmV1LmF1dGh6LmNsb3VkZW50aXR5LmlvL3Rob21hc21pbGxlci90ZXN0L3Rlc3QtcHJvZmlsZSJdLCJleHAiOjE2NjI5MzQ5MDMsImlhdCI6MTY2MjkzMTMwMywiaWRwIjoiZDcyODJlYzI0MjUyNDE0NThjM2MxYjRkZTlkOTNjYTEiLCJpc3MiOiJodHRwczovL3Rob21hc21pbGxlci5ldS5hdXRoei5jbG91ZGVudGl0eS5pby90aG9tYXNtaWxsZXIvdGVzdCIsImp0aSI6ImY0YzMyNmU1LTlmNmQtNDQ5Ni05YjhhLWExNmY0ODFiMGM0NyIsIm5iZiI6MTY2MjkzMTMwMywic2NwIjpbImVtYWlsIiwib3BlbmlkIiwicHJvZmlsZSJdLCJzdCI6InB1YmxpYyIsInN1YiI6ImM2NDljNDQ0OGFkZDQ0ZWY1ZDA1NjEwY2JlMDEwNDU1Yjk5Y2RkZDdjMmU1MDY1YTYxNTNhYWI4ZTM5YzVhODkiLCJ0aWQiOiJ0aG9tYXNtaWxsZXIifQ.OgKf6CSojaV07UnIXUk7McATha2-TRbvGOcuCtUYMnZI8lyq2M6tpe_ueZB6sttK-h9xvUnMurKvYf9zOGs6qA")
}

** Notes **

Looks to be have introduced in https://github.com/spring-projects/spring-security/issues/7160

thomasmillergb avatar Sep 12 '22 17:09 thomasmillergb