Jwt Decode using PyJWT raises Signature verification failed

Question

I'm running into a weird issue with decoding the jwt token in the django views. If I try jwt.decode('encoded_token', 'secret') then I see the "Signature verification failed" message. In order to escape from this issue I've set the verify flag to False:

jwt.decode('eroded_token', 'secret', verify=False)

This gives the decoded payload with no error but I'm trying to figure out how I can verify the token successfully without setting the verify flag to False. Any Ideas?

Thanks

Jot

Answer 1

That is not an actual JWT token you are trying to verify - it should look more like this - three strings concatenated together with periods (and of course be created as an actual JSON Web Token):

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE1NTk1ODM2MjAsImV4cCI6MTU1OTU4MzY4MH0.P9bO39jqwB3YHf7XSo16OSLvcNMYbm__hrf70J9VzYw

You can create a web token via:

import jwt
encoded = jwt.encode({'some': 'payload'}, 'secret', algorithm='HS256')
print(encoded)

O/P:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzb21lIjoicGF5bG9hZCJ9.4twFt5NiznN84AWoo1d7KO1T_yoc0Z6XOpOVswacPZg

`

taken from https://github.com/jpadilla/pyjwt

Toscana