why jwt token is showing invalid signature in spring security 6 by pasting it in jwt.io

46 Views Asked by At

I'm using Spring Security 6 using Nimbus token. Here is my security configuration ..

@Bean
public JwtDecoder jwtDecoder() {
    return NimbusJwtDecoder.withPublicKey( jwtConfigProperties.getPublicKey()).build();
} 

@Bean 
public JwtEncoder jwtEncoder(){ 
    JWK jwk = new RSAKey.Builder( jwtConfigProperties.getPublicKey()).privateKey(jwtConfigProperties.getPrivateKey()).build(); 
    JWKSource<SecurityContext> jwks = new ImmutableJWKSet<>(new JWKSet(jwk));
    return new NimbusJwtEncoder(jwks);
}

Here's my jwt configuration properties for RSA public and private key..

public class RsaKeyProperties {

    private RSAPrivateKey privateKey;
    
    private RSAPublicKey publicKey;
    
    @Autowired
    KeyGeneratorUtility keygen;

    @PostConstruct
    public void init() {
        KeyPair keyPair = keygen.generateKey();
        
        this.privateKey = (RSAPrivateKey) keyPair.getPrivate();
        System.out.println("rsa private key : "+privateKey);
        this.publicKey = (RSAPublicKey) keyPair.getPublic();
        System.out.println("rsa public key : "+publicKey);
    }
}

And here's to generate RSA public and private key programmatically.

public class KeyGeneratorUtility {
    
    public KeyPair generateKey() {
        
        KeyPair keyPair;

        try{
            KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
            keyPairGenerator.initialize(2048);
            keyPair = keyPairGenerator.generateKeyPair();
        } catch(Exception e){
            throw new IllegalStateException();
        }

        return keyPair;
    }
}

And here is to generate token programmatically.

public String generateToken(ProductUser produser) {
        Instant now = Instant.now();
        String scope = produser.getAuthorities().stream().map(GrantedAuthority::getAuthority).collect(Collectors.joining(" "));
        
        JwtClaimsSet claims = JwtClaimsSet.builder()
                .issuer("self")
                .issuedAt(now)
                .expiresAt(now.plus(1, ChronoUnit.HOURS))
                .subject(produser.getUsername())
                .claim("scope", scope)
                .build();
        
        return this.encoder.encode(JwtEncoderParameters.from(claims)).getTokenValue();
    }

This is an auto-generated token after hitting API from postman with status 200 OK

eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJzZWxmIiwic3ViIjoic2F5YW50YW51c2VyIiwiZXhwIjoxNjkyNzY1MTU5LCJpYXQiOjE2OTI3NjE1NTksInNjb3BlIjoidXNlcjpjcmVhdGUgdXNlcjpkZWxldGUgdXNlcjp1cGRhdGUgdXNlcjpyZWFkIFJPTEVfVVNFUiJ9.LtLP0YcniqgKbhqMkTOWtBMqGLKP1nk5xKWZhELmsISCFTPmMbCVCAPikJqz9psW3QjoMWgbOoia3_saohrbPI1EfTIYb_P0K5bh3eD2StIK0B4ywf39-ENvzE9Zt9GuRTWHQ7tk1cBJv9YhqZxDzmFbZdPDBB1ZWYXGLxBhKec8vVlidGA0UqPKNiZhSFoop3mjmzu2N4kah7WZ__q20ccFeS52icKXyw8kpFbxiasouWRLPjy75nwgcYhXASKfs5TSYPyzppCTE1cqQ3CzVOv21xpzK6QjD9hnTz8aqrsz8mFTFxd0VRqenwLx1s9SiHldfG0DK_umd9w_83muoQ

But after pasting this token with JWT.io it is showing invalid signature enter image description here

An idea what am I doing wrong? Is my approach incorrect? Please help me out.

0

There are 0 best solutions below