How to validate the jwt on server?

[ywj79310]

From client, I sent a RS256 to the server.

In server, I am using jsonwebtoken to validate it.
However, it requires a secret key:

io.use(function(socket, next){
  if (socket.handshake.query && socket.handshake.query.token){
    jwt.verify(socket.handshake.query.token, 'SECRET_KEY', function(err, decoded) {
      if (err) return next(new Error('Authentication error'));
      socket.decoded = decoded;
      next();
    });
  }
  else {
    next(new Error('Authentication error'));
  }    
})

How to get the secret key?

[dan.woda]

Hi @ywj79310,

Welcome to the Auth0 Community!

For an RS256 signed token, you will need the token’s Public Key. You can manually add the key to that library, or fetch the JWKS programatically. There are examples of both in the README for that library: GitHub - auth0/node-jsonwebtoken: JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html

If you are using Auth0, you can find the key following this resource:

Where is the Auth0 public key to be used in jwt.io to verify the signature of a RS256 token?

We use an Auth0 account. I paste an Auth0-generated token into JSON Web Tokens - jwt.io . It shows me the header and payload but for the VERIFY SIGNATURE section it asks me to paste in a public RSA key or certificate or a private RSA key in order to verify the signature. I can see I have a secret for each client we’ve registered in Auth0. But where I can find, or how can I create, an RSA key or certificate?