如何在Python中用JWK解码JWT令牌

Question

我正在开发一个应用程序，其中所有API都受OAuth保护。我已从客户端收到访问令牌，但无法解码和验证令牌

我有以下格式的JWK

{
  "keys": [
    {
      "kty": "RSA",
      "x5t#S256": "Some value",
      "e": "Some Value",
      "x5t": "Some Value",
      "kid": "SIGNING_KEY",
      "x5c": [
        "Some Value"
      ],
      "key_ops": [
        "verify",
        "encrypt"
      ],
      "alg": "RS256",
      "n": "Some Value"
    }
  ]
}

如何在Python中使用上述JWK解码JWT令牌

Answer 1

快速检查jwt令牌https://jwt.io/

否则您可以尝试此操作，但您应该知道用于生成令牌的算法（例如：HS256）和用于签名令牌的密钥（例如：super_secretkey）

import jwt # pip install pyjwt[crypto] to install the package
jwt.decode(token, key='super_secretkey', algorithms=['HS256', ])

使用JWK更新并解码JWT

import json
import jwt

#for JWKS that contain multiple JWK
public_keys = {}
for jwk in jwks['keys']:
    kid = jwk['kid']
    public_keys[kid] = jwt.algorithms.RSAAlgorithm.from_jwk(json.dumps(jwk))

kid = jwt.get_unverified_header(token)['kid']
key = public_keys[kid]

payload = jwt.decode(token, key=key, algorithms=['RS256'])