If signature is without payload then how to verify it

[dalvishreya106]

Hi ,

If signature is without payload then how to verify it.

Signature sample= edhknnkkoifdfio…thkkmvccbmmkbbnmk

Please tell me.

Kindest Regards,
Shreya

[tyf]

Hey there @dalvishreya106 welcome to the community!

@dalvishreya106

If signature is without payload then how to verify it.

Is there a reason in particular your token doesn’t have a payload? Typically, this is considered an opaque token and is due to the fact that there was no audience specified in the authorization flow. The audience param here is key in that is the identifier of your API, and let’s the API (whichever library you are using to verify) that it is indeed the intended audience.

[dalvishreya106]

I m getting this token from external API call and I m getting response in below format:
{
signature:“”,
response:“”
}

hence payload is not included in signature.

I am unable to verify digital signature with public key and detached payload:

Hi Team,

I have a response from the external API in the below format:

const inputData = {
signature: ‘eyJhbGciOiJSUzI1NiIsImtpZCI6InNhbXBsZS1rZXktaWQifQ…SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c’,
response: ‘jdskhfgdjskfgkjsdhf’
};
The signature is without the payload check (“…”) in inputData signature, and I am trying to verify the signature.

My public key format is:

PublicKey: {
“kty”: “RSA”,
“e”: “AQAB”,
“use”: “sig”,
“kid”: “erityuiuerot”,
“n”: “kjfghdsjkbfdasbf”
}
The inputData is:

const inputData = {
signature: ‘eyJhbGciOiJSUzI1NiIsImtpZCI6InNhbXBsZS1rZXktaWQifQ…SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c’,
response: ‘jdskhfgdjskfgkjsdhf’
};
I am using the below code to verify it in nodejs:

const jose = require(“node-jose”);

async function createKeystore() {
const keystore = jose.JWK.createKeyStore();

// Add the public key to the keystore
const key = await keystore.add({
    kty: 'RSA',
    kid: "erityuiuerot",
    use: 'sig',
    alg: 'RS256',
    n: "kjfghdsjkbfdasbf",
    e: 'AQAB'
}, 'json');

return keystore;

}

async function verifyDetachedJWS(jws, payload) {
try {
const keystore = await createKeystore();
console.log(“keystore”, keystore);
// Use JWS.createVerify to verify the token
const verifier = jose.JWS.createVerify(keystore);

   const result = await verifier.verify(jws);

    console.log('Verification successful:', result);
} catch (error) {
    console.error('Verification failed:', error);
}

}

// Example JWS token (without payload) and payload (replace with your actual values)
const jws = ‘eyJhbGciOiJSUzI1NiIsImtpZCI6InNhbXBsZS1rZXktaWQifQ…SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c’;

verifyDetachedJWS(jws, payload);
But I am getting the following error:

Verification failed: Error: no key found
at processSig (/node_modules/node-jose/lib/jws/verify.js:132:22)
I am unable to figure out where the issue is. Can you please help me resolve this as soon as possible?

Do I need to use private for verification, if yes then please suggest code how to do it.

my private key is in below format :

PrivateKey : {
keys : [{
“p”: “”,
“kty”: “RSA”,
“q”: “”,
“d”: “”,
“e”: “”,
“use”: “sig”,
“kid”: “”,
“qi”: “”,
“dp”: “”,
“dq”: “”,
“n”: “”
}]
};

Kindest Regards,