3

Please help me to decode this jwt USING python jose module. I don't know what key I should use. because any online jwt decoder can decode it without any key.

token = eyJhbGciOiJSUzI1NiIsImtpZCI6ImVlYTFiMWY0MjgwN2E4Y2MxMzZhMDNhM2MxNmQyOWRiODI5NmRhZjAiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMDEyODA4NDEwNzU2MjUwMzQwMjAiLCJlbWFpbCI6ImRzYjMyMW1wQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoiWmpVY1Eyd3JkLUdzY3F2Y2dqci1BQSIsIm5vbmNlIjoiUFp2SGhsX2tUTGR1Sktmem80LW9qdyIsImlhdCI6MTYxMTY5MjA2NywiZXhwIjoxNjExNjk1NjY3fQ.kNFbqjtJO2HKsSX-jt967MLi2xjeRH4W9JsA4yPQDQEgrHqa3BX6PVFJCBjq-Fn7vmlTT1lUcElVPwtvcBUV8Z4I7dCuWKcTxTt6R8501f1I2X0tQeEu_zfg-ianzOlQkg3KvLT_D-oaIfNkoU7jAt4Mywe6xHiDKszlA6KE8T6PLV_VeiCJGvciLbPW7DhKiuL-kfTjhHoZ6_XHeruR6rb_psZNvH5t-D3Yjc27EwH0_Wumcl1GjN20eF2xO-UDhO4BMRHGIM5876QUYB58dxblLG1flEaeXi9z4R-XnrLPYpAYZDYQDcPMni9fUm9d8pNZDeTGh6WyGkTqkXuHvg

I tryied:

jwt.decode(token=token, key=???, algorithms='RS256')

salius
  • 918
  • 1
  • 14
  • 30

2 Answers2

3

Using PyJWT:

import jwt
from jwt import PyJWKClient


token = "eyJhbGciOiJSUzI1NiIsImtpZCI6ImVlYTFiMWY0MjgwN2E4Y2MxMzZhMDNhM2MxNmQyOWRiODI5NmRhZjAiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMDEyODA4NDEwNzU2MjUwMzQwMjAiLCJlbWFpbCI6ImRzYjMyMW1wQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoiWmpVY1Eyd3JkLUdzY3F2Y2dqci1BQSIsIm5vbmNlIjoiUFp2SGhsX2tUTGR1Sktmem80LW9qdyIsImlhdCI6MTYxMTY5MjA2NywiZXhwIjoxNjExNjk1NjY3fQ.kNFbqjtJO2HKsSX-jt967MLi2xjeRH4W9JsA4yPQDQEgrHqa3BX6PVFJCBjq-Fn7vmlTT1lUcElVPwtvcBUV8Z4I7dCuWKcTxTt6R8501f1I2X0tQeEu_zfg-ianzOlQkg3KvLT_D-oaIfNkoU7jAt4Mywe6xHiDKszlA6KE8T6PLV_VeiCJGvciLbPW7DhKiuL-kfTjhHoZ6_XHeruR6rb_psZNvH5t-D3Yjc27EwH0_Wumcl1GjN20eF2xO-UDhO4BMRHGIM5876QUYB58dxblLG1flEaeXi9z4R-XnrLPYpAYZDYQDcPMni9fUm9d8pNZDeTGh6WyGkTqkXuHvg"

# Insecure - doesn't validate the token.
decoded = jwt.decode(token, options={"verify_signature": False})

# Optional, not sure if if this increases security
url = "https://www.googleapis.com/oauth2/v3/certs"
client = PyJWKClient(url)
pub_key = client.get_signing_key_from_jwt(token).key
aud = jwt.decode(token, options={"verify_signature": False})["aud"]
decoded = jwt.decode(token, pub_key, algorithms=["RS256"], audience=aud, options={"verify_exp": False})
goalie1998
  • 1,427
  • 1
  • 9
  • 16
  • but how https://jwt.io/ can decode it in this case? – salius Jan 26 '21 at 21:20
  • Take a look at [this](https://stackoverflow.com/questions/64297228/where-does-jwt-io-get-the-public-key-from-jwt-token) – goalie1998 Jan 26 '21 at 21:40
  • It explains how jwt.io is able to decode your token. – goalie1998 Jan 26 '21 at 21:54
  • @ goalie1998 I mean I don't know how to apply this info because I don't have any endpoint `./well-known-endpoint` on my localhost. I found this endpoint `https://www.googleapis.com/oauth2/v3/certs` from the question, but also I don't know how I can use it. – salius Jan 26 '21 at 22:02
  • Do you have to use jose, or can you use pyjwt? – goalie1998 Jan 26 '21 at 22:23
  • `jose` is much more preferable, but `pyjwt` is also adopted. I heard that `pyjwt in some sense is deprecated at nowadays` – salius Jan 26 '21 at 22:36
  • .Thank u! All this time I was looking for a solution with jose, but after their examples fall from docs I desperate and moved toward a pyjwt :) BTW, `aud` I have from credentials. But I still no have idea of what I'm doing and how it's working, particularly a moment with PyJWKClient and the audience. Why I can't just download these dicts (https://www.googleapis.com/oauth2/v3/certs) and use it from a file or variable without using a network – salius Jan 27 '21 at 05:05
  • You probably can, I don't know how though – goalie1998 Jan 27 '21 at 06:45
  • @salius decoding a JWT is never the problem, it's just base64url encoded JSON, everyone can decode it and you don't need a key. The key is for verification. You'll probably see "invalid signature " if you don't provide the key. – jps Jan 27 '21 at 14:56
  • @jps No, jose just can't decode jwt because `key` is the required argument. The second problem is bugs in wring documentation in `jose`. Fro example https://github.com/mpdavis/python-jose/issues/183 – salius Jan 27 '21 at 15:02
  • 1
    @salius I was refering to the question why JWT.io can decode. Yes, jwt.decode needs a key, that's true. And the "problem" is, that many jwt libs call the function just `decode` but also need a key because the also verify the signature. – jps Jan 27 '21 at 15:03
3

python-jose uses jwt.get_unverified_header() and jwt.get_unverified_claims().

from jose import jwt

token = "eyJhbGciOiJSUzI1NiIsImtpZCI6ImVlYTFiMWY0MjgwN2E4Y2MxMzZhMDNhM2MxNmQyOWRiODI5NmRhZjAiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMDEyODA4NDEwNzU2MjUwMzQwMjAiLCJlbWFpbCI6ImRzYjMyMW1wQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoiWmpVY1Eyd3JkLUdzY3F2Y2dqci1BQSIsIm5vbmNlIjoiUFp2SGhsX2tUTGR1Sktmem80LW9qdyIsImlhdCI6MTYxMTY5MjA2NywiZXhwIjoxNjExNjk1NjY3fQ.kNFbqjtJO2HKsSX-jt967MLi2xjeRH4W9JsA4yPQDQEgrHqa3BX6PVFJCBjq-Fn7vmlTT1lUcElVPwtvcBUV8Z4I7dCuWKcTxTt6R8501f1I2X0tQeEu_zfg-ianzOlQkg3KvLT_D-oaIfNkoU7jAt4Mywe6xHiDKszlA6KE8T6PLV_VeiCJGvciLbPW7DhKiuL-kfTjhHoZ6_XHeruR6rb_psZNvH5t-D3Yjc27EwH0_Wumcl1GjN20eF2xO-UDhO4BMRHGIM5876QUYB58dxblLG1flEaeXi9z4R-XnrLPYpAYZDYQDcPMni9fUm9d8pNZDeTGh6WyGkTqkXuHvg"

claims = jwt.get_unverified_claims(token)
header = jwt.get_unverified_header(token)

See below for details.

okamoto
  • 31
  • 1