Written by Jamie Tanna
on February 25, 2019
CC-BY-NC-SA-4.0 Apache-2.0
3 mins

Verifying Signed JWTs (JWS) with Node.JS

When you're working with JSON Web Tokens (JWTs), you'll almost certainly be validating that the contents of the token is sent by the correct service by verifying the token's signature.

However if these are, for instance, access tokens, you should not be putting them into an online tool like JWT.io as you pose a risk of information leakage, as well as potentially compromising accounts!

Even though the website says it should be done client-side, it's still a bad practice to randomly copy-paste potentially dangerous data around.

So how do you easily validate the signature, without it touching an easy-to-use service? Below you can find a simple code snippet to do the work for you using Node.JS' jsonwebtoken and node-jose libraries.

Using jsonwebtoken

The below code will verify the signature and then return a process error code if the signature does not match, using the jsonwebtoken library (v8.5.0):

const fs = require('fs');
const jwt = require('jsonwebtoken');

const args = process.argv.slice(2);

const publicKey = fs.readFileSync(args[1]);

theJwt = fs
	.readFileSync(args[0])
	.toString()
	// required to handle newlines at the end of file, otherwise jsonwebtoken
	// doesn't like it!
	.replace(/\n$/, '');

try {
	jwt.verify(theJwt, publicKey);
} catch (e) {
	process.exit(1);
}

Which we can see in action below:

$ node sig.js valid.jwt public.pem
$ echo $?
0
$ node sig.js invalid.jwt public.pem
$ echo $?
1

Using node-jose

The below code will verify the signature and then return a process error code if the signature does not match, using the node-jose library (v1.1.1):

const fs = require('fs');
const jose = require('node-jose');

const args = process.argv.slice(2);

const jwt = fs.readFileSync(args[0]).toString();
const publicKey = fs.readFileSync(args[1]);

(async () => {
	const key = await jose.JWK.asKey(publicKey, 'pem');
	const verifier = jose.JWS.createVerify(key);
	const verified = await verifier
		.verify(jwt)
		.catch(()=>{});
	// coerce to a truthy value
	const isVerified = !!verified;
	process.exit(false == isVerified);
})();

Which we can see in action below:

$ node sig.js valid.jwt public.pem
$ echo $?
0
$ node sig.js invalid.jwt public.pem
$ echo $?
1

As we can see, very straightforward!

Note: You will notice that this expects the publicKey to be a PEM file. If you wish to amend this, please consult the node-jose docs.

Setup

The example data here has been adapted from data in JWT.io.

The public key to be used for verification is:

And the private key that was used to sign the tokens is:

A JWS with a valid signature:

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.TCYt5XsITJX1CxPCT8yAV-TVkIEq_PbChOMqsLfRoPsnsgw5WEuts01mq-pQy7UJiN5mgRxD-WUcX16dUEMGlv50aqzpqh4Qktb3rk-BuQy72IFLOqV0G_zS245-kronKb78cPN25DGlcTwLtjPAYuNzVBAh4vGHSrQyHUdBBPM

Which has contents:

{
	"alg": "RS256",
	"typ": "JWT"
}
{
	"sub": "1234567890",
	"name": "John Doe",
	"admin": true,
	"iat": 1516239022
}

A JWS with an invalid signature:

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.TCYt5XsITJX1CxPCT8yAV-TVkIEq_PbChOMqsLfRoPsnsgw5WEuts01mq-pQy7UJiN5mgRxD-WUcX16dUEMGlv50aqzpqh4Qktb3rk-BuQy72IFLOqV0G_zS245-kronKb78cPN25DGlcTwLtjPAYuNzVBAh4vGHSrQyHUdBBPM

Which has the contents:

{
	"alg": "RS256",
	"typ": "JWT"
}
{
	"sub": "1234567890",
	"name": "Jane Doe",
	"admin": true,
	"iat": 1516239022
}

Written by Jamie Tanna on Mon, 25 Feb 2019 22:13:43 UTC, and last updated on Tue, 10 Mar 2020 22:15:19 UTC.

Content for this article is shared under the terms of the Creative Commons Attribution Non Commercial Share Alike 4.0 International, and code is shared under the Apache License 2.0.

#blogumentation #nodejs #command-line #jwt #json.

This post was filed under articles.

Has this content helped you? Please consider supporting me so I can continue to create content like this!

Verifying Signed JWTs (JWS) with Node.JS

Using jsonwebtoken

Using node-jose

Setup

Interactions with this post