JWT Web Signature Invalid

Hi, I am generating JWT token when user logs in and adding email and password as claims :

             rsaJsonWebKey =  RsaJwkGenerator.generateJwk(2048);
             rsaJsonWebKey.setKeyId(userId);
            JwtClaims claims = new JwtClaims();
    claims.setExpirationTimeMinutesInTheFuture(1440); 
    claims.setGeneratedJwtId(); 
    claims.setIssuedAtToNow(); 
    claims.setClaim("email",email); 
    claims.setClaim("password", password);      
            claims.setSubject("user");


    JsonWebSignature jws = new JsonWebSignature();
    jws.setPayload(claims.toJson());
    jws.setKey(rsaJsonWebKey.getPrivateKey());
    jws.setKeyIdHeaderValue(rsaJsonWebKey.getKeyId());
    jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256);
    jwt = jws.getCompactSerialization();

On generation of this token I store rsaJsonWebKey in JSON format in db against unique identifier for user. This token is sent back to the user which is sent along every request that comes in from user.

On every request, I query for all db records with this user unique ID like :

          for(JWTConfig publicKey : config)  //for each record for user
        {
        PublicJsonWebKey jsonWebKey = PublicJsonWebKey.Factory.newPublicJwk(publicKey.getWebkey());
             RsaJsonWebKey rsaJsonWebKey = new RsaJsonWebKey((RSAPublicKey) jsonWebKey.getPublicKey());
             rsaJsonWebKey.setKeyId(userId);   //ths is unique user Id 
             jsonWebKeys.add(rsaJsonWebKey);
        }



        JwksVerificationKeyResolver jwksVerificationKeyResolver = new JwksVerificationKeyResolver(jsonWebKeys);



            JwtConsumer jwtConsumer = new JwtConsumerBuilder()
                .setRequireExpirationTime()
                .setRequireSubject()
                .setVerificationKeyResolver(jwksVerificationKeyResolver)
                .build();

            jwtClaims = jwtConsumer.processToClaims(token);

This works for now. As you can login from multiple devices , I have many records in db for same user. Now if user changes password and logs in, token claims would have new password, But when I try to resolve , I get Invalid JWT Exception, which says that web signature is invalid and lets say there were 2 db records with old password and 1 with new one , new one that got created at login isn't getting validated.

I really need to fix this issue asap.

Note : I tried to delete tokens with old pwd from db, and then tried to validate it worked. I don't know if its issue with key resolver. Please do the needful.

Thanks.

Comments (11)