I’m trying to verify an AWS Cognito JWT. The closest help I have found is this thread: https://forum.elixirforum.com/t/joken-using-joken-verify/10081/5 I’m attempting a similar technique: authorization = conn |> get_req_header("authorization") [authorizationHeaderValue | rest] = authorization jwt…

It is difficult to know how you’ve signed your token. Though this token has a different “kid” claim on its header than the one your passing for JOSE.JWK.from_map/1. Does this help? The kid on the token is: ttY6v6AGiOqL+ZaDvyg953iG7RWLTwDVq9+cOa1hrZE=\

i’ve tryed with this kid and the same token awsJwks = Poison.decode!(~s({“alg”:“RS256”,“e”:“AQAB”,“kid”:“ttGiOqL+ZaDvyg953iG7R=”,“kty”:“RSA”,“n”:“q70S6cdm28a0LRj_o8QP7Getgh-QygM7iKRp5QIcyEO2rie-Gas7QyW8k1uTHJT68gxdoV8hverMwWw2H7L1Y7ec6-jN1tsq1ExYQbi8ELDxzCpeDF_e4FKp2COZEdV_CVN8qxdC6aBTIN7dSNP_gw_XI…

@cs-victor-nascimento Thanks for your reply! @reneerojas and I are working on the same problem :slight_smile: To clarify, we are trying to verify JWTs signed by AWS, which provides the following public key set: https://cognito-idp.us-east-1.amazonaws.com/us-east-1_WhtpCXeoU/.well-known/jwks.json I…

I had to do something similar with Auth0, I ended up just using JOSE directly instead of Joken though. But anyway, it looks like what you’re missing to me is the fact that the jwks is actually a key set. Meaning you need to get your token from the list before you try to verify. Assuming you only h…

@Azolo Yeah, the Auth0 JWK set is exactly the same format as the AWS set, so I think we need your function, thanks! How are you verifying after extracting the key? Using Joken for that? Cheers, Robert

Well you’re supposed to use the data in the JWT to get the name of the key in the jwks, but I was pretty frustrated at that point, so I just did: defp check_against_jwks(token, jwks) do Enum.any?(jwks, fn(jwk) -> case JOSE.JWT.verify_strict(jwk, ["RS256"], token) do {true, _, _} ->…

Cool! We will give a try just directly with JOSE.JWT :slight_smile: Cheers, Robert

@Azolo Worked! Wow, great: Clears a big block for us. We’ll use your technique :slight_smile: Cheers, Robert

I’ve stumbled upon the same issue - thanks for the useful answers, which pointed me the right way :smiley: I actually took it a little further and got it integrated with Joken: ’ “forked” Joken.Plug and modified line 174 to pass the connection: verified_token = payload_fun.(conn) (see https://git…

Elixir Programming Language Forum

Joken: Verify AWS Cognito JWT

Questions & Help Questions

Azolo February 9, 2018, 4:16pm 10

Glad I could help