r/aws•
rdkls

Complaint: ALB OIDC JWTs Invalid

technical question

I've implemented auth on ALB per

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html

The doc calls out "Note that standard libraries are not compatible with padding that is included in the Application Load Balancer authentication token in JWT format."

I just have to wonder why the hell this is; why implement something that doesn't conform to spec. I can validate with pyjwt, but nothing else that follows spec e.g. jwt.io, or noedjs middleware.

Anyone know of node libraries that are more forgiving like the pyjwt one?

Posted Aug 31, 2022, 8:30 AM UTC

06
cyanawesome•

According to this discussion jose package supports AWS' invalid JWTs. v1 at least.

1
rdklsOP•

Thank you I’ll check it out

edit: I did and it does, shame it's incompatible with all our old libs

1
regular_sam•

I found this code snippet to work well enough for signature validation.

1
rdklsOP•

Thank you!

1
chbsftd•

any reason you cannot use x-amzn-oidc-accesstoken?

1
rdklsOP•

Need the payload with email

1