Skip to content

Fix DPoP jkt claim to be JWK SHA-256 thumbprint #17080

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Fix DPoP jkt claim to be JWK SHA-256 thumbprint #17080

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
195e4a4
Fix JWK Thumbprint calculation to conform to RFC7638
dkowis May 8, 2025
45f5232
Removed unused hash calculation
dkowis May 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 4 additions & 7 deletions ...gframework/security/oauth2/server/resource/authentication/DPoPAuthenticationProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,25 +193,22 @@ public OAuth2TokenValidatorResult validate(Jwt jwt) {
return OAuth2TokenValidatorResult.failure(error);
}

PublicKey publicKey = null;
JWK jwk = null;
@SuppressWarnings("unchecked")
Map<String, Object> jwkJson = (Map<String, Object>) jwt.getHeaders().get("jwk");
try {
JWK jwk = JWK.parse(jwkJson);
if (jwk instanceof AsymmetricJWK) {
publicKey = ((AsymmetricJWK) jwk).toPublicKey();
}
jwk = JWK.parse(jwkJson);
}
catch (Exception ignored) {
}
if (publicKey == null) {
if (jwk == null) {
OAuth2Error error = createOAuth2Error("jwk header is missing or invalid.");
return OAuth2TokenValidatorResult.failure(error);
}

String jwkThumbprint;
try {
jwkThumbprint = computeSHA256(publicKey);
jwkThumbprint = jwk.computeThumbprint().toString();
}
catch (Exception ex) {
OAuth2Error error = createOAuth2Error("Failed to compute SHA-256 Thumbprint for jwk.");
Expand Down
20 changes: 7 additions & 13 deletions ...ework/security/oauth2/server/resource/authentication/DPoPAuthenticationProviderTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
import java.util.Map;
import java.util.UUID;

import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.source.JWKSource;
import com.nimbusds.jose.proc.SecurityContext;
Expand Down Expand Up @@ -218,8 +219,8 @@ public void authenticateWhenJktMissingThenThrowOAuth2AuthenticationException() t

@Test
public void authenticateWhenJktDoesNotMatchThenThrowOAuth2AuthenticationException() throws Exception {
// Use different client public key
Jwt accessToken = generateAccessToken(TestKeys.DEFAULT_EC_KEY_PAIR.getPublic());
// Use different jwk to make it not match
Jwt accessToken = generateAccessToken(TestJwks.DEFAULT_EC_JWK);
JwtAuthenticationToken jwtAuthenticationToken = new JwtAuthenticationToken(accessToken);
given(this.tokenAuthenticationManager.authenticate(any())).willReturn(jwtAuthenticationToken);

Expand Down Expand Up @@ -285,14 +286,14 @@ public void authenticateWhenDPoPProofValidThenSuccess() throws Exception {
}

private Jwt generateAccessToken() {
return generateAccessToken(TestKeys.DEFAULT_PUBLIC_KEY);
return generateAccessToken(TestJwks.DEFAULT_RSA_JWK);
}

private Jwt generateAccessToken(PublicKey clientPublicKey) {
private Jwt generateAccessToken(JWK clientJwk) {
Map<String, Object> jktClaim = null;
if (clientPublicKey != null) {
if (clientJwk != null) {
try {
String sha256Thumbprint = computeSHA256(clientPublicKey);
String sha256Thumbprint = clientJwk.computeThumbprint().toString();
jktClaim = new HashMap<>();
jktClaim.put("jkt", sha256Thumbprint);
}
Expand Down Expand Up @@ -321,11 +322,4 @@ private static String computeSHA256(String value) throws Exception {
byte[] digest = md.digest(value.getBytes(StandardCharsets.UTF_8));
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
}

private static String computeSHA256(PublicKey publicKey) throws Exception {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] digest = md.digest(publicKey.getEncoded());
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
}

}