Skip to content

fix(core): infer JWT algorithms for JWKS keys without alg #3434

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
strantalis merged 4 commits into from
May 6, 2026
Merged

fix(core): infer JWT algorithms for JWKS keys without alg #3434

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fc3b2f1
fix(auth): infer JWT algorithms for JWKS keys without alg
strantalis May 5, 2026
f5ba6bb
test(auth): clarify missing alg JWKS fixture
strantalis May 5, 2026
b0a571b
test(auth): make JWKS alg fixture explicit
strantalis May 5, 2026
fcdca1f
test(core): assert JWKS key omits alg
strantalis May 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion service/internal/auth/token_verifier.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"time"

"github.com/lestrrat-go/jwx/v2/jwk"
"github.com/lestrrat-go/jwx/v2/jws"
"github.com/lestrrat-go/jwx/v2/jwt"

"github.com/opentdf/platform/service/logger"
Expand Down Expand Up @@ -89,7 +90,7 @@ func (v *TokenVerifier) VerifyAccessToken(ctx context.Context, tokenRaw string)
}

token, err := jwt.Parse([]byte(tokenRaw),
jwt.WithKeySet(v.cachedKeySet),
jwt.WithKeySet(v.cachedKeySet, jws.WithInferAlgorithmFromKey(true)),
jwt.WithValidate(true),
jwt.WithIssuer(v.oidcConfiguration.Issuer),
jwt.WithAudience(v.oidcConfiguration.Audience),
Expand Down
41 changes: 40 additions & 1 deletion service/internal/auth/token_verifier_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,22 @@ type tokenVerifierFixture struct {
}

func newTokenVerifierFixture(t *testing.T) *tokenVerifierFixture {
privateKey, publicKeyJWK := newTokenVerifierKeyPair(t)
require.NoError(t, publicKeyJWK.Set(jwk.AlgorithmKey, jwa.RS256))

return newTokenVerifierFixtureWithPublicKey(t, privateKey, publicKeyJWK)
}

func newTokenVerifierFixtureWithoutPublicKeyAlgorithm(t *testing.T) *tokenVerifierFixture {
privateKey, publicKeyJWK := newTokenVerifierKeyPair(t)
require.NoError(t, publicKeyJWK.Remove(jwk.AlgorithmKey))
_, hasAlgorithm := publicKeyJWK.Get(jwk.AlgorithmKey)
require.False(t, hasAlgorithm)

return newTokenVerifierFixtureWithPublicKey(t, privateKey, publicKeyJWK)
}

func newTokenVerifierKeyPair(t *testing.T) (*rsa.PrivateKey, jwk.Key) {
t.Helper()

privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
Expand All @@ -33,7 +49,12 @@ func newTokenVerifierFixture(t *testing.T) *tokenVerifierFixture {
publicKeyJWK, err := jwk.FromRaw(privateKey.PublicKey)
require.NoError(t, err)
require.NoError(t, publicKeyJWK.Set(jws.KeyIDKey, "test-key"))
require.NoError(t, publicKeyJWK.Set(jwk.AlgorithmKey, jwa.RS256))

return privateKey, publicKeyJWK
}

func newTokenVerifierFixtureWithPublicKey(t *testing.T, privateKey *rsa.PrivateKey, publicKeyJWK jwk.Key) *tokenVerifierFixture {
t.Helper()

keySet := jwk.NewSet()
require.NoError(t, keySet.AddKey(publicKeyJWK))
Expand Down Expand Up @@ -149,6 +170,24 @@ func TestTokenVerifier_VerifyAccessToken(t *testing.T) {
_, err = verifier.VerifyAccessToken(t.Context(), token)
require.Error(t, err)
})

t.Run("valid token with JWKS key missing alg", func(t *testing.T) {
missingAlgFixture := newTokenVerifierFixtureWithoutPublicKeyAlgorithm(t)

missingAlgVerifier, err := NewTokenVerifier(t.Context(), AuthNConfig{
Issuer: missingAlgFixture.server.URL,
Audience: "test-audience",
CacheRefresh: "15m",
TokenSkew: time.Minute,
}, logger.CreateTestLogger())
require.NoError(t, err)

token := missingAlgFixture.signToken(t, missingAlgFixture.server.URL, "test-audience", missingAlgFixture.privateKey)

verifiedToken, err := missingAlgVerifier.VerifyAccessToken(t.Context(), token)
require.NoError(t, err)
assert.Equal(t, "user-123", verifiedToken.Subject())
})
}

func TestTokenVerifier_NilHandling(t *testing.T) {
Expand Down
Loading