hasura / hasura/graphql-engine

Issue with JWT Verification When Using Base64 Encoded Secret

Open
#10,120 3 comments 2 reactions 0 assignees View on GitHub
k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: 2.27

### Environment

### What is the current behaviour?

We are encountering an issue with JWT token verification in Hasura. Our setup works correctly when the JWT is signed with a secret key using UTF-8 encoding. However, when we switch to using Base64 encoding for the secret key, Hasura fails to verify the JWT token.

````
import { createSecretKey } from 'crypto';
import { JWTPayload, SignJWT } from 'jose';

const secret = createSecretKey(
process.env.NEXTAUTH_SECRET as string,
'utf-8'
);

const signedJwt = new SignJWT(payload)
.setProtectedHeader({ alg: 'HS256' })
.setSubject(user.id)
.setIssuedAt()
.setExpirationTime(Date.now() + monthAsMilicseconds)
//.setIssuer(issuer || 'hasura-auth')
.sign(secret);
````

However, when attempting to sign the JWT with a Base64 encoded secret, Hasura is unable to verify the token. The code change is as follows:

````
const secret = createSecretKey(
process.env.NEXTAUTH_SECRET as string,
'base64'
);

const signedJwt = new SignJWT(payload)
.setProtectedHeader({ alg: 'HS256' })
.setSubject(user.id)
.setIssuedAt()
.setExpirationTime(Date.now() + monthAsMilicseconds)
//.setIssuer(issuer || 'hasura-auth')
.sign(secret, { crit: { b64: true } });

````

This results in the following error from Hasura:

````
{
"errors": [
{
"extensions": {
"code": "invalid-jwt",
"path": "$"
},
"message": "Could not verify JWT: JWSError JWSInvalidSignature"
}
]
}
````

We were hoping to specify the encoding as "base64" in the HASURA_GRAPHQL_JWT_SECRET environment variable (e.g., {"key":"super-secret-key","type":"HS256"}), but it seems this is not supported according to the documentation.

### What is the expected behaviour?

Hasura should be able to verify JWT tokens signed with a Base64 encoded secret key.

### How to reproduce the issue?

1. Generate a JWT token using a Base64 encoded secret key.
2. Attempt to use this token with a Hasura instance configured with the corresponding secret key.

### Keywords

- JWT
- Base64 Encoding
- Token Verification
- Hasura JWT Authentication

Contributor guide

Open the contributing guide

Research direction

Start with the HASURA_GRAPHQL_JWT_SECRET configuration and the JWT verification path, comparing how UTF-8 and Base64 secrets are interpreted. Reproduce the JWSInvalidSignature case using the two signing examples, then verify that a token signed with a Base64-encoded secret is accepted when the corresponding configuration is used.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, backend-api-design, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.