javajwtjava-securitygoogle-http-client

Google OAuth2 JWT token verification exception


I'm facing OAuth2 JWT token verification exception last hour (so no one can access my application):

java.security.SignatureException: Signature length not correct: got 256 but was expecting 128. I'm using google-http-client 1.20.0 and Java 1.7.0. Same configuration worked so far - any ideas?

Stacktrace

java.security.SignatureException: Signature length not correct: got 256 but was expecting 128
    at sun.security.rsa.RSASignature.engineVerify(Unknown Source) ~[na:1.7.0_45]
    at java.security.Signature$Delegate.engineVerify(Unknown Source) ~[na:1.7.0_45]
    at java.security.Signature.verify(Unknown Source) ~[na:1.7.0_45]
    at com.google.api.client.util.SecurityUtils.verify(SecurityUtils.java:164) ~[google-http-client-1.20.0.jar:1.20.0]

Solution

  • Same problem here, I added the source code of GoogleIdTokenVerifier to my project and changed the method:

     public boolean verify(GoogleIdToken googleIdToken) throws GeneralSecurityException, IOException {
        // check the payload
        if (!super.verify(googleIdToken)) {
          return false;
        }
        // verify signature
        for (PublicKey publicKey : publicKeys.getPublicKeys()) {
          try {
            if (googleIdToken.verifySignature(publicKey)) {
                return true;
              }
        } catch (Exception e) {
            System.err.println("Verify Token:" + e);
        }
        }
        return false;
      }
    

    just handle the exception, the second certificate works fine.

    Edit: you can subclass as Erik-z suggested if you want to make it more clean:

    Edit 2: I can't make it work using the code below, I will stick to the ugly hack above.

    package com.my.project.package;
    
    import java.io.IOException;
    import java.security.GeneralSecurityException;
    import java.security.PublicKey;
    
    import com.google.api.client.auth.openidconnect.IdTokenVerifier;
    import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken;
    import com.google.api.client.googleapis.auth.oauth2.GoogleIdTokenVerifier;
    import com.google.api.client.http.HttpTransport;
    import com.google.api.client.json.JsonFactory;
    
    // Remember to remove this class later by making it deprecated
    @Deprecated
    public class GoogleIdTokenVerifier2 extends GoogleIdTokenVerifier {
    
        // Add constructors as needed
        public GoogleIdTokenVerifier2(HttpTransport transport, JsonFactory jsonFactory) {
            super(transport, jsonFactory);
        }
    
        @Override
        public boolean verify(GoogleIdToken googleIdToken) throws GeneralSecurityException, IOException {
            // check the payload
            if (!((IdTokenVerifier)this).verify(googleIdToken)) {
                return false;
            }
            // verify signature
            for (PublicKey publicKey : getPublicKeysManager().getPublicKeys()) {
                try {
                    if (googleIdToken.verifySignature(publicKey)) {
                        return true;
                    }
                } catch (Exception e) {
                    System.err.println("Verify Token:" + e);
                }
            }
            return false;
        }
    }