如何在python中使用x和y坐标验证ES384 JWT签名 [英] How to validate ES384 JWT signature with x and y coordinate in python

问题描述

我有一个如下的JWT:

<预> <代码>授权:承载eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsImtpZCI6IjQ0ODIzZjNkLTBiMDEtNGE2Yy1hODBlLWI5ZDNlOGE3MjI2ZiIsImprdSI6Imh0dHBzOi8vc2FuZGJveC5jZHMtaG9va3Mub3JnLy53ZWxsLWtub3duL2p3a3MuanNvbiJ9.eyJpc3MiOiJodHRwczovL3NhbmRib3guY2RzLWhvb2tzLm9yZyIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9jZHMtc2VydmljZXMiLCJleHAiOjE1OTQyMzA5MDAsImlhdCI6MTU5NDIzMDYwMCwianRpIjoiZWZiMzc3M2QtM2EyOC00M2UyLTlmYmMtYjkzNmE5YWUzODhiIn0.Cbey3n5NkDRoCLHZ2WMFc1z_RY8Rlq5oGxdAYfbrBPMiJXLCwjbYoU0av2CQj-Olhbnpe7Vs8vzJ5oHP5gc2-0ooc5J49t4Uz9iYKpiM9KLUrqaJe0umc_klM2-ynHAI

我一直在努力，因为诸如PyJWT的python库要求用于椭圆曲线算法的PEM格式公钥，而且我必须解码base64才能获得具有"jku"标记的标头.( https://sandbox.cds-hooks.org/.well-known/jwks.json )，只有x和y坐标，没有公钥.

我觉得我完全朝着错误的方向发展，因为我认为这应该是一种使用ES384 alg验证JWT的简单而自动化的过程.

如果有人可以帮助解释如何使用库/python代码对此进行验证，那将是救生员！

解决方案

您可以为此使用Jose-JWT库:

  pip install python-jose安装 

使用Jose-JWT，您可以根据给定的键构造密钥JWK 或直接在中使用JWK( JSON Web密钥)解码调用，如以下简短示例所示:

来自jose import jwk，jwt的

 es384_key = {"kty":"EC"，"crv":"P-384"，孩子":"44823f3d-0b01-4a6c-a80e-b9d3e8a7226f"，"use":"sig"，"alg":"ES384"，"x":"dw_JGR8nB2I6XveNxUOl2qk699ZPLM2nYI5STSdiEl9avAkrm3CkfYMbrrjr8laB"，"y":"Sm3mLE-n1zYNla_aiE3cb3nZsL51RbC7ysw3q8aJLxGm-hx79RPMYpITDjp7kgzy"}allowed_aud ="http://127.0.0.1:8000/cds-services"令牌=" eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsImtpZCI6IjQ0ODIzZjNkLTBiMDEtNGE2Yy1hODBlLWI5ZDNlOGE3MjI2ZiIsImprdSI6Imh0dHBzOi8vc2FuZGJveC5jZHMtaG9va3Mub3JnLy53ZWxsLWtub3duL2p3a3MuanNvbiJ9.eyJpc3MiOiJodHRwczovL3NhbmRib3guY2RzLWhvb2tzLm9yZyIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9jZHMtc2VydmljZXMiLCJleHAiOjE1OTQyMzA5MDAsImlhdCI6MTU5NDIzMDYwMCwianRpIjoiZWZiMzc3M2QtM2EyOC00M2UyLTlmYmMtYjkzNmE5YWUzODhiIn0.Cbey3n5NkDRoCLHZ2WMFc1z_RY8Rlq5oGxdAYfbrBPMiJXLCwjbYoU0av2CQj-Olhbnpe7Vs8vzJ5oHP5gc2-0ooc5J49t4Uz9iYKpiM9KLUrqaJe0umc_klM2-ynHAI"有效负载= jwt.decode(令牌，es384_key，听众= allowed_aud，选项= {'verify_exp':False})打印(有效负载) 

即使被称为 decode ，该函数实际上也会验证签名.

注意:我添加了 options = {'verify_exp':False} 以避免错误，因为您的令牌昨天已经过期.

输出:

  {'iss':'https://sandbox.cds-hooks.org'，'aud':'http://127.0.0.1:8000/cds-services'，'exp':1594230900，'iat':1594230600，'jti':'efb3773d-3a28-43e2-9fbc-b936a9ae388b'} 

I have a JWT that is as follows:

Authorization: Bearer eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsImtpZCI6IjQ0ODIzZjNkLTBiMDEtNGE2Yy1hODBlLWI5ZDNlOGE3MjI2ZiIsImprdSI6Imh0dHBzOi8vc2FuZGJveC5jZHMtaG9va3Mub3JnLy53ZWxsLWtub3duL2p3a3MuanNvbiJ9.eyJpc3MiOiJodHRwczovL3NhbmRib3guY2RzLWhvb2tzLm9yZyIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9jZHMtc2VydmljZXMiLCJleHAiOjE1OTQyMzA5MDAsImlhdCI6MTU5NDIzMDYwMCwianRpIjoiZWZiMzc3M2QtM2EyOC00M2UyLTlmYmMtYjkzNmE5YWUzODhiIn0.Cbey3n5NkDRoCLHZ2WMFc1z_RY8Rlq5oGxdAYfbrBPMiJXLCwjbYoU0av2CQj-Olhbnpe7Vs8vzJ5oHP5gc2-0ooc5J49t4Uz9iYKpiM9KLUrqaJe0umc_klM2-ynHAI

I've been struggling since python libraries like PyJWT require a PEM format public key for Elliptical curve algorithms, and I'm having to decode the base64 to get the header which has the "jku" (https://sandbox.cds-hooks.org/.well-known/jwks.json) which only has the x and y coordinates and not a public key.

I feel like I'm going completely into the wrong direction for what I imagine should be a simple and automated process for validating a JWT with the ES384 alg.

If anyone can help to explain how to validate this with a library/python code it would be a life saver!

解决方案

You can use the Jose-JWT library for that:

pip install python-jose

With Jose-JWT you can either construct a key from the given JWK or use the JWK (JSON Web Key) directly in the decodecall, as shown in the following short example:

from jose import jwk, jwt

es384_key = {
    "kty": "EC",
    "crv": "P-384",
    "kid": "44823f3d-0b01-4a6c-a80e-b9d3e8a7226f",
    "use": "sig",
    "alg": "ES384",
    "x": "dw_JGR8nB2I6XveNxUOl2qk699ZPLM2nYI5STSdiEl9avAkrm3CkfYMbrrjr8laB",
    "y": "Sm3mLE-n1zYNla_aiE3cb3nZsL51RbC7ysw3q8aJLxGm-hx79RPMYpITDjp7kgzy"
}

allowed_aud = "http://127.0.0.1:8000/cds-services"
token = "eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsImtpZCI6IjQ0ODIzZjNkLTBiMDEtNGE2Yy1hODBlLWI5ZDNlOGE3MjI2ZiIsImprdSI6Imh0dHBzOi8vc2FuZGJveC5jZHMtaG9va3Mub3JnLy53ZWxsLWtub3duL2p3a3MuanNvbiJ9.eyJpc3MiOiJodHRwczovL3NhbmRib3guY2RzLWhvb2tzLm9yZyIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9jZHMtc2VydmljZXMiLCJleHAiOjE1OTQyMzA5MDAsImlhdCI6MTU5NDIzMDYwMCwianRpIjoiZWZiMzc3M2QtM2EyOC00M2UyLTlmYmMtYjkzNmE5YWUzODhiIn0.Cbey3n5NkDRoCLHZ2WMFc1z_RY8Rlq5oGxdAYfbrBPMiJXLCwjbYoU0av2CQj-Olhbnpe7Vs8vzJ5oHP5gc2-0ooc5J49t4Uz9iYKpiM9KLUrqaJe0umc_klM2-ynHAI"

payload = jwt.decode(
                token,
                es384_key,
                audience = allowed_aud,
                options = {'verify_exp':False})

print (payload)

Even though it's called decode, the function in fact verifies the signature.

Note: I added options = {'verify_exp':False} to avoid an error, because your token already expired yesterday.

Output:

{'iss': 'https://sandbox.cds-hooks.org', 'aud': 'http://127.0.0.1:8000/cds-services', 'exp': 1594230900, 'iat': 1594230600, 'jti': 'efb3773d-3a28-43e2-9fbc-b936a9ae388b'}

这篇关于如何在python中使用x和y坐标验证ES384 JWT签名的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！