0

I am getting started with Kong. I successfully did a simple authentication system with Oauth2 plugin, but now I have some troubles with the JWT one.

I searched a lot but there's lack of documentation and resources about this topic.

I followed the guide here: https://getkong.org/plugins/jwt/

I created a consumer with his JWT credentials:

{
"secret": "6b965bcbf48a4ea7a170bf56557e14c1",
"id": "5587b664-c8b5-4941-95fe-f6e03c319fa4",
"algorithm": "HS256",
"created_at": 1500473323000,
"key": "6fad7730b5134fbb9d74d356d838c9b4",
"consumer_id": "459cc6ab-fd62-4510-80cc-4eb48e5326a3"
}

Then I opened https://jwt.io/ and many other tools to generate a key. Anyways here the data I entered:

Header

{
"typ": "JWT",
"alg": "HS256"
}

Payload

{
"iss": "6fad7730b5134fbb9d74d356d838c9b4"
}

Verify signature

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  6b965bcbf48a4ea7a170bf56557e14c1
)

The tool returns a key I use then as Authorization header:

Authorization: Bearer <token>

Unfortunately the response from the server is always 401:

{
"error_description": "The access token is invalid or has expired",
"error": "invalid_token"
}

If I send a broken token or a token generated from wrong data, I receive a different error message.

What am I doing wrong here?

4

1 回答 1

2

解决了。

基本上对同一个 API 进行更多测试，我应用了两个插件（Oauth2 和 JWT），然后产生了冲突。

正如我所说，我才刚刚开始，所以对于新手来说，请注意不要在同一个 API 上使用更多的身份验证插件。

于 2017-07-20T15:58:16.103 回答