Fail to verify a manipulated token

Hi hello,

I created below code just based on the example code from the homepage, just trying to learn how to verify a token with public jwk or public key. While doing that i ran into something weird: even if i added one charactor at the end of the signature of the token, the token can still pass verification; if added more than one character, the verification is doing fine.

Tried with below scenarios:

(1)Any length of chars added at the beginning or in the middle of the signature, the verification is working fine

(2)One char added at the end of the signature, the verification is failing, the modified token can still pass verification

(3)More than one char added at the end of the signature, the verification is working fine

(4)Any length of chars added in header section or payload section at any position, the verification is working fine

The code is as below:

package token.jwt;

import com.nimbusds.jose.*;
import com.nimbusds.jose.crypto.*;
import com.nimbusds.jose.jwk.*;
import com.nimbusds.jose.jwk.gen.*;
import com.nimbusds.jwt.SignedJWT;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;

public class Test {

   public static void main(String[] args) throws Exception {
      // Generate an EC key pair
      ECKey ecJWK = new ECKeyGenerator(Curve.P_256)
            .keyID("123")
            .generate();
      ECKey ecPublicJWK = ecJWK.toPublicJWK();

      // Create the EC signer
      JWSSigner signer = new ECDSASigner(ecJWK);

      // Creates the JWS object with payload
      JWSObject jwsObject = new JWSObject(
            new JWSHeader.Builder(JWSAlgorithm.ES256).keyID(ecJWK.getKeyID()).build(),
            new Payload("Elliptic cure"));

      // Compute the EC signature
      jwsObject.sign(signer);

      // Serialize the JWS to compact form
      String s = jwsObject.serialize();

      // Manipulated the original token and use it later
      SignedJWT jwt = SignedJWT.parse(s + "X");

      // The recipient creates a verifier with the public EC key
      JWSVerifier verifier = new ECDSAVerifier(ecPublicJWK);

      // Verify the EC signature of the manipulated token
      assertTrue("ES256 signature verified", jwt.verify(verifier));
      assertEquals("Elliptic cure", jwt.getPayload().toString());
   }
}

And i am using version 5.4.1

Not sure if i missed anything or miss-understood anything.

Any suggestions on how to workaround this would be appreciated!

So many thanks,

leonL

Comments (12)