Issue trying to get JWK using JwksClient

[nkshah2]

Describe the problem

Our JWK provider issues JWKs with the following format

{
    keys: [
        {
            kty: 'RSA',
            kid: 'string',
            n: 'string',
            e: 'string',
            alg: 'RS256',
            use: 'sig'
        }
    ]
}

which is a valid JWK (im not too familiar with different formats so correct me if im wrong here). When trying to verify a JWT using the JwksClient the package throws (paths are stripped)

JwksError: The JWKS endpoint did not contain any signing keys
    at JwksClient.getSigningKeys (/node_modules/jwks-rsa/src/JwksClient.js:64:13)
    at processTicksAndRejections (/process/task_queues.js:95:5)
    at async JwksClient.getSigningKey (/node_modules/jwks-rsa/src/JwksClient.js:73:18)

The json response did contain an array with a key inside it

What was the expected behavior?

The provided JWK should be considered valid and the package should not throw an error

Reproduction

Unfortunately I cant share my code since its an organisation project, Im also not too sure on how to go about reproducing it in a sample project but I suppose if you have an endpoint that is serving a JSON with the format mentioned above the following code snippet can be used to reproduce it

let jwt = "somejwt"
let JWKSRSA = require("jwks-rsa");

let client  = new JWKSRSA.JwksClient({
    jwksUri: `https://someapi/jwks.json`,
})

await client.getSigningKey(jwt)

Environment

• Version of this library used: 2.0.4
• Which framework are you using, if applicable: NodeJS
• Other modules/plugins/libraries that might be involved: --
• Any other relevant information you think would be useful: --

[adamjmcgrath]

Hi @nkshah2 - thanks for raising this

getSigningKey takes a kid (Key ID), so you need to pass it the kid claim from the header of your JWT rather than the whole JWT itself.

[adamjmcgrath]

JwksError: The JWKS endpoint did not contain any signing keys

Also, could you share your jwks.json endpoint (eg https://brucke.auth0.com/.well-known/jwks.json)? They're public keys so it should be publically available

[nkshah2]

Hi, I should've updated this earlier. Turns out in some cases the kty in the public key was "rsa" and not "RSA" which caused the logic to filter keys to return an empty array. After getting that fixed everything is working fine.

Thanks anyway!

[adamjmcgrath]

Great - thanks for letting me know @nkshah2!