Auth0, error decoding access token with HS256 encrypt algorithm

Help
1

Hi, I whant to make a function that check if the access token is valid ussing Auth0 in Python.

Now, the token could be encrypted with HS256 or RS256 algorithms.

The next code works all fine with the RS256 algorithms, but return a Excepcion Expected a string value with the other encrypt algorithms, why?

def is_valid_token(access_token, audience, algorithms):
    AUTH0_DOMAIN = 'dev-47ysz721.auth0.com'

    jsonurl = req.urlopen('https://' + AUTH0_DOMAIN + '/.well-known/jwks.json')
    jwks = json.loads(jsonurl.read())
    cert = '-----BEGIN CERTIFICATE-----\n' + jwks['keys'][0]['x5c'][0] + '\n-----END CERTIFICATE-----'
    certificate = load_pem_x509_certificate(cert.encode('utf-8'), default_backend())
    public_key = certificate.public_key()

    try:
        decoded = jwt.decode(access_token, public_key, audience=audience, algorithms=algorithms)
    except Exception as e:
        print 'Excepcion', e
        return None
    return decoded
2

I find a solution, not much recommended but work fine. is adding the paramenter verify=False, the result of the code is:

if algorithms=='HS256':
        decoded = jwt.decode(access_token, public_key, audience=audience, algorithms=[algorithms], verify=False)
else:
        decoded = jwt.decode(access_token, public_key, audience=audience, algorithms=[algorithms])

See: verify

3

Thanks a lot for sharing it with the rest of community!

1 Like