[SOLVED] JWT signature does not match locally computed signature

JWT signature does not match locally computed signature

I am using

Key                secret = MacProvider.generateKey();
SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
byte[]             apiKeySecretBytes = secret.getEncoded();
Key                signingKey = new SecretKeySpec(apiKeySecretBytes, SignatureAlgorithm.getJcaName());

JwtBuilder builder = Jwts.builder()
                    .setId(user.getEmail())
                    .signWith(signatureAlgorithm, signingKey);

to create a token then

Jwts.parser().setSigningKey(secret).parse(token);

to authenticate. When I run this in a JUnit test, it works fine. However, when I authenticate token passed as a header over REST call, authentication fails with SignatureException. I have verified the token on both ends of the HTTP call and the token string is identical. Code to create/authenticate is static, therefore, the secret is same on each side.

Solution

static Key secret = MacProvider.generateKey(); will generate a new random key each time your server is reloaded because static variables are initialized when the class is loaded

It means that if you issue a JWT, it is only valid as long as the server does not reboot. The SignatureException you got is because the signing key it is different

You need to store the signing key secret.getEncoded() after first generation and load it when your module starts