Python decode jwt token USING JOSE module

Question

Please help me to decode this jwt USING python jose module. I don't know what key I should use. because any online jwt decoder can decode it without any key.

token = eyJhbGciOiJSUzI1NiIsImtpZCI6ImVlYTFiMWY0MjgwN2E4Y2MxMzZhMDNhM2MxNmQyOWRiODI5NmRhZjAiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMDEyODA4NDEwNzU2MjUwMzQwMjAiLCJlbWFpbCI6ImRzYjMyMW1wQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoiWmpVY1Eyd3JkLUdzY3F2Y2dqci1BQSIsIm5vbmNlIjoiUFp2SGhsX2tUTGR1Sktmem80LW9qdyIsImlhdCI6MTYxMTY5MjA2NywiZXhwIjoxNjExNjk1NjY3fQ.kNFbqjtJO2HKsSX-jt967MLi2xjeRH4W9JsA4yPQDQEgrHqa3BX6PVFJCBjq-Fn7vmlTT1lUcElVPwtvcBUV8Z4I7dCuWKcTxTt6R8501f1I2X0tQeEu_zfg-ianzOlQkg3KvLT_D-oaIfNkoU7jAt4Mywe6xHiDKszlA6KE8T6PLV_VeiCJGvciLbPW7DhKiuL-kfTjhHoZ6_XHeruR6rb_psZNvH5t-D3Yjc27EwH0_Wumcl1GjN20eF2xO-UDhO4BMRHGIM5876QUYB58dxblLG1flEaeXi9z4R-XnrLPYpAYZDYQDcPMni9fUm9d8pNZDeTGh6WyGkTqkXuHvg

I tryied:

jwt.decode(token=token, key=???, algorithms='RS256')

Carsoncarstensz

What have you tried already? Can you provide a code example? Have you looked at the documentation? – Arms

@RandomDavis I added a reason to the question – Carsoncarstensz

What was the output? Was there an error? Are you using the correct algorithm? Is the key correct? – Arms

@Arms I added a reason to the question – Carsoncarstensz

@Carsoncarstensz have you tried just omitting the key argument altogether? – Winwaloe

@Random Davis Yeah, but key is required argument, jwt.decode(token=token, algorithms='RS256') >>> TypeError: decode() missing 1 required positional argument: 'key' – Carsoncarstensz

Answer 1

Using PyJWT:

import jwt
from jwt import PyJWKClient


token = "eyJhbGciOiJSUzI1NiIsImtpZCI6ImVlYTFiMWY0MjgwN2E4Y2MxMzZhMDNhM2MxNmQyOWRiODI5NmRhZjAiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMDEyODA4NDEwNzU2MjUwMzQwMjAiLCJlbWFpbCI6ImRzYjMyMW1wQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoiWmpVY1Eyd3JkLUdzY3F2Y2dqci1BQSIsIm5vbmNlIjoiUFp2SGhsX2tUTGR1Sktmem80LW9qdyIsImlhdCI6MTYxMTY5MjA2NywiZXhwIjoxNjExNjk1NjY3fQ.kNFbqjtJO2HKsSX-jt967MLi2xjeRH4W9JsA4yPQDQEgrHqa3BX6PVFJCBjq-Fn7vmlTT1lUcElVPwtvcBUV8Z4I7dCuWKcTxTt6R8501f1I2X0tQeEu_zfg-ianzOlQkg3KvLT_D-oaIfNkoU7jAt4Mywe6xHiDKszlA6KE8T6PLV_VeiCJGvciLbPW7DhKiuL-kfTjhHoZ6_XHeruR6rb_psZNvH5t-D3Yjc27EwH0_Wumcl1GjN20eF2xO-UDhO4BMRHGIM5876QUYB58dxblLG1flEaeXi9z4R-XnrLPYpAYZDYQDcPMni9fUm9d8pNZDeTGh6WyGkTqkXuHvg"

# Insecure - doesn't validate the token.
decoded = jwt.decode(token, options={"verify_signature": False})

# Optional, not sure if if this increases security
url = "https://www.googleapis.com/oauth2/v3/certs"
client = PyJWKClient(url)
pub_key = client.get_signing_key_from_jwt(token).key
aud = jwt.decode(token, options={"verify_signature": False})["aud"]
decoded = jwt.decode(token, pub_key, algorithms=["RS256"], audience=aud, options={"verify_exp": False})

Arms

but how jwt.io can decode it in this case? – Carsoncarstensz

Take a look at this – Arms

It explains how jwt.io is able to decode your token. – Arms

@ goalie1998 I mean I don't know how to apply this info because I don't have any endpoint ./well-known-endpoint on my localhost. I found this endpoint https://www.googleapis.com/oauth2/v3/certs from the question, but also I don't know how I can use it. – Carsoncarstensz

Do you have to use jose, or can you use pyjwt? – Arms

jose is much more preferable, but pyjwt is also adopted. I heard that pyjwt in some sense is deprecated at nowadays – Carsoncarstensz

.Thank u! All this time I was looking for a solution with jose, but after their examples fall from docs I desperate and moved toward a pyjwt :) BTW, aud I have from credentials. But I still no have idea of what I'm doing and how it's working, particularly a moment with PyJWKClient and the audience. Why I can't just download these dicts (googleapis.com/oauth2/v3/certs) and use it from a file or variable without using a network – Carsoncarstensz

You probably can, I don't know how though – Arms

@Carsoncarstensz decoding a JWT is never the problem, it's just base64url encoded JSON, everyone can decode it and you don't need a key. The key is for verification. You'll probably see "invalid signature " if you don't provide the key. – Corissa

@Corissa No, jose just can't decode jwt because key is the required argument. The second problem is bugs in wring documentation in jose. Fro example github.com/mpdavis/python-jose/issues/183 – Carsoncarstensz

@Carsoncarstensz I was refering to the question why JWT.io can decode. Yes, jwt.decode needs a key, that's true. And the "problem" is, that many jwt libs call the function just decode but also need a key because the also verify the signature. – Corissa

Answer 2

python-jose uses jwt.get_unverified_header() and jwt.get_unverified_claims().

from jose import jwt

token = "eyJhbGciOiJSUzI1NiIsImtpZCI6ImVlYTFiMWY0MjgwN2E4Y2MxMzZhMDNhM2MxNmQyOWRiODI5NmRhZjAiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiIxNjcwMzExMDQ1NjYtYmZpMmgyODdzMWYxdTFzaWFicGI1ZWo4OHExa25nMnMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMDEyODA4NDEwNzU2MjUwMzQwMjAiLCJlbWFpbCI6ImRzYjMyMW1wQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoiWmpVY1Eyd3JkLUdzY3F2Y2dqci1BQSIsIm5vbmNlIjoiUFp2SGhsX2tUTGR1Sktmem80LW9qdyIsImlhdCI6MTYxMTY5MjA2NywiZXhwIjoxNjExNjk1NjY3fQ.kNFbqjtJO2HKsSX-jt967MLi2xjeRH4W9JsA4yPQDQEgrHqa3BX6PVFJCBjq-Fn7vmlTT1lUcElVPwtvcBUV8Z4I7dCuWKcTxTt6R8501f1I2X0tQeEu_zfg-ianzOlQkg3KvLT_D-oaIfNkoU7jAt4Mywe6xHiDKszlA6KE8T6PLV_VeiCJGvciLbPW7DhKiuL-kfTjhHoZ6_XHeruR6rb_psZNvH5t-D3Yjc27EwH0_Wumcl1GjN20eF2xO-UDhO4BMRHGIM5876QUYB58dxblLG1flEaeXi9z4R-XnrLPYpAYZDYQDcPMni9fUm9d8pNZDeTGh6WyGkTqkXuHvg"

claims = jwt.get_unverified_claims(token)
header = jwt.get_unverified_header(token)

See below for details.

• Reading the Claimset without Validation
• Reading Headers without Validation

Contrapuntal