Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Fail to verify a OAuth2 RS256 id_token from implicit flow: invalid algorithm

See original GitHub issue

Hi! I’m using jsonwebtoken to validate an id_token server side, but it fails with:

{ JsonWebTokenError: invalid algorithm
    at /home/.../node_modules/jsonwebtoken/verify.js:110:19

The IdP is Google, the algorithm is RS256.

Background: I’m using the implicit flow to get an id_token from Google entirely in JS to avoid using server resources / to avoid having to remember a state/nonce etc. Once I have one I send it to the server but I wish to verify it.

I must be doing something wrong but I can’t seem to find what it is. Any idea?

Issue Analytics

State:
Created 5 years ago
Comments:5 (3 by maintainers)

Top GitHub Comments

2reactions

benjicommented, Sep 4, 2018

OK got it, thank you. For future reference, I did not have a certificate from Google OAuth UI configuration but it can be retrieved with an API call. More details here: https://developers.google.com/identity/protocols/OpenIDConnect#validatinganidtoken

0reactions

MitMarocommented, Sep 4, 2018

Great to hear you figured it out. 😃

Top Results From Across the Web

Troubleshoot Invalid Token Errors - Auth0

Error Message: The ID token cannot be validated because it was signed using the HS256 algorithm and public applications (such as a browser)...

Microsoft identity platform ID tokens

The ID token is the core extension that OpenID Connect makes to OAuth 2.0. ID tokens are issued by the authorization server and...

OpenID Connect (OIDC) authorization code flow mechanism

The Authorization Code Flow mechanism authenticates users of your web application by redirecting them to an OIDC provider, such as Keycloak, to log...

Get Access token with Postman - invalid algorithm

The reason for the verification failure is due to the issuer being set to Okta authorization server instead of a custom authorization server....

Draft: OpenID Connect Implicit Client Implementer's Guide 1.0

To validate an Access Token issued with an ID Token in the Implicit Flow, the Client SHOULD do the following: Hash the octets...