Signature verification fails for access token

Question

Hello,

Signature verification of access token fails with JWKS https://login.microsoftonline.com/b41b72d0-4e9f-4c26-8a69-f949f367c91d/discovery/keys?appId=04f73406-aedb-4bb3-8697-9381e2cedc8b

JWT header:

{
  "typ": "JWT",
  "nonce": "2mcGtFKjeHKlOzPqxjvOM9_OD5EQeYfGu6YtfEFHuBk",
  "alg": "RS256",
  "x5t": "T1St-dLTvyWRgxB_676u8krXS-I",
  "kid": "T1St-dLTvyWRgxB_676u8krXS-I"
}

Signature algorithm SHA256withRSA returns <code>false</code>: computed(from public key) and provided(from access token) singatures are different. It worked fine 2-3 days ago.

Could you please help me with that issue?

Answer 1

The reason signature verification fails for Access Token is the 'nonce' field in its JWT header. It should be represented as an SHA256 hash. Before signature verification, the SHA256 hash of current value of 'nonce' should be calculated and be replaced with that: header.nonce = sha256(header.nonce).

C# code example can be found at Stack Overflow: https://stackoverflow.com/a/71588115/2659770

On the other hand, Access Token is not designed to be validated by you or shared to someone else (e.g. your server side), its audience is the Graph API, validation, signatuer verification etc. is done by Graph API.

Answer 2

Hi @Aliaksandr Stsiapanay , to verify the access token signature, you need to obtain the public key from the JSON Web Key Set (JWKS) endpoint and use it to verify the signature of the access token.

In your case, the JWKS endpoint is login.microsoftonline.com/b41b72d0-4e9f-4c26-8a69-f949f367c91d/discovery/keys?appId=04f73406-aedb-4bb3-8697-9381e2cedc8b.You can use a tool like openssl to verify the signature of the access token. Here is an example command:

openssl dgst -sha256 -verify <(openssl x509 -in <(curl -s https://login.microsoftonline.com/b41b72d0-4e9f-4c26-8a69-f949f367c91d/discovery/keys?appid=04f73406-aedb-4bb3-8697-9381e2cedc8b | jq -r '.keys[0].x5c[0] | "-----BEGIN CERTIFICATE-----\n" + . + "\n-----END CERTIFICATE-----"')) -signature <(echo "" | base64 -d) <(echo -n ".")

Replace <SIGNATURE> with the signature from the access token, <HEADER> with the base64-encoded header of the access token, and <PAYLOAD> with the base64-encoded payload of the access token.

If the signature verification fails, it is possible that the public key has changed or the access token has been tampered with. You can try obtaining a new access token and verifying its signature again.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

Answer 3

Interesting information.

So for what the access tokens are supposed to be used? I guess they can be used to collect "user info" from the userinfo_endpoint?