hasura / hasura/graphql-engine
Issue with JWT Verification When Using Base64 Encoded Secret
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version: 2.27
### Environment
### What is the current behaviour?
We are encountering an issue with JWT token verification in Hasura. Our setup works correctly when the JWT is signed with a secret key using UTF-8 encoding. However, when we switch to using Base64 encoding for the secret key, Hasura fails to verify the JWT token.
````
import { createSecretKey } from 'crypto';
import { JWTPayload, SignJWT } from 'jose';
const secret = createSecretKey(
process.env.NEXTAUTH_SECRET as string,
'utf-8'
);
const signedJwt = new SignJWT(payload)
.setProtectedHeader({ alg: 'HS256' })
.setSubject(user.id)
.setIssuedAt()
.setExpirationTime(Date.now() + monthAsMilicseconds)
//.setIssuer(issuer || 'hasura-auth')
.sign(secret);
````
However, when attempting to sign the JWT with a Base64 encoded secret, Hasura is unable to verify the token. The code change is as follows:
````
const secret = createSecretKey(
process.env.NEXTAUTH_SECRET as string,
'base64'
);
const signedJwt = new SignJWT(payload)
.setProtectedHeader({ alg: 'HS256' })
.setSubject(user.id)
.setIssuedAt()
.setExpirationTime(Date.now() + monthAsMilicseconds)
//.setIssuer(issuer || 'hasura-auth')
.sign(secret, { crit: { b64: true } });
````
This results in the following error from Hasura:
````
{
"errors": [
{
"extensions": {
"code": "invalid-jwt",
"path": "$"
},
"message": "Could not verify JWT: JWSError JWSInvalidSignature"
}
]
}
````
We were hoping to specify the encoding as "base64" in the HASURA_GRAPHQL_JWT_SECRET environment variable (e.g., {"key":"super-secret-key","type":"HS256"}), but it seems this is not supported according to the documentation.
### What is the expected behaviour?
Hasura should be able to verify JWT tokens signed with a Base64 encoded secret key.
### How to reproduce the issue?
1. Generate a JWT token using a Base64 encoded secret key.
2. Attempt to use this token with a Hasura instance configured with the corresponding secret key.
### Keywords
- JWT
- Base64 Encoding
- Token Verification
- Hasura JWT Authentication
Contributor guide
Research direction
Start with the HASURA_GRAPHQL_JWT_SECRET configuration and the JWT verification path, comparing how UTF-8 and Base64 secrets are interpreted. Reproduce the JWSInvalidSignature case using the two signing examples, then verify that a token signed with a Base64-encoded secret is accepted when the corresponding configuration is used.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, backend-api-design, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100