Hello guys I have a question about microservice JWT verifica

Question

Hello guys I have a question about microservice JWT verification Been following through the docs but still didn t understand

porcellus · Answer

hi ask away

Leonxx · Answer

This is from your docs

Leonxx · Answer

my question is it can be used

Leonxx · Answer

jwt should be taken from headers

porcellus · Answer

The most straightforward way to do machine to machine auth is the authorization header I d say

porcellus · Answer

just to clarify this is between two of your microservices

Leonxx · Answer

yes

porcellus · Answer

So yeah I d use an authorization header to transfer this token between them

Leonxx · Answer

yes I understand that give me a sec I will try something

Leonxx · Answer

I send a request from UI I receive data and forward this request with generated JWT token to MS I receive this JWT and I hve trouble with verifing it

Leonxx · Answer

Thos are headers that I receive on MS

porcellus · Answer

how are you sending parsing this header I m just guessing but you might be missing a base 64 decode while parsing it

Leonxx · Answer

there is nothing said about base 64

Leonxx · Answer

jwt I should get from headers authorization right

porcellus · Answer

sure but the authorization header in your screenshot looks like it has been base 64 encoded

Leonxx · Answer

I m using your library and nothing more

porcellus · Answer

can you show me how you make the call to the other microservice

porcellus · Answer

or how you are adding the authorization header

porcellus · Answer

oh I see the screenshot was just cut off weirdly and I missed s

porcellus · Answer

what goes wrong while verifying it

porcellus · Answer

also you can copy and paste the token into jwt io to check

Leonxx · Answer

token is not valid

Leonxx · Answer

token generated by createJWT is not walid in jwt io

porcellus · Answer

hmm could you paste the token here

Leonxx · Answer

eyJraWQiOiI0NTg5NDcxYS1lMDQ1LTQ3ZGQtOGY3NC1lNjFlNDNkOTVmODEiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9 eyJkYXRhIjoic2RmIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDozMDAwIiwic291cmNlIjoibWljcm9zZXJ2aWNlIiwiZXhwIjo0ODE4NzM4MzczLCJpYXQiOjE2NjUxMzgzNzJ9 EgOymmM2uuaSIe09P6jAWIaI6Pg6M1mvF8KF1XqKN0 MpF3ZdTbKB 5KoQtYrQqX567x Xqu55IAgRhyA9RC0XD3aXekOkRW5TsnCq1dK xPKK pdVGpNtAgSDMdj99worepk8qIBKQYkU68RG DauGbCUDzRFV4Rb dk6xObFv0GxEcIU3pMz45ynPqIWZwexIWy2i W7flUdq AYugzoZlR qGLnjnvQkrQIi8UTiadsTQFUfCwJYODKsuT0Rqz9o2qJ7ghFf9IcxqJX7A 8EdsIKj1r2K5RMGtPyOr4PyZ4oQpJdaJTAdTT i0hcY7fQJTO8OQ6MI7g2bg1hSdQ

porcellus · Answer

pasting this seems to be working for me

porcellus · Answer

I mean they can t check the signature of course because they d need the jwks endpoint of backend to do that

Leonxx · Answer

So it should be invalid then

porcellus · Answer

the signature checking won t work on jwt io if you don t copy paste your keys that s correct but on the right you should be able to see your data decoded

Leonxx · Answer

yes that I saw

porcellus · Answer

what goes wrong what exception are you getting while verifying the token

porcellus · Answer

can you also show how you are doing that

porcellus · Answer

right so please try and log the value of the jwt before calling verify

porcellus · Answer

what I think you ll find is that you didn t cut off the Bearer prefix

Leonxx · Answer

nope I didn t

Leonxx · Answer

but in this case should I send this prefix

porcellus · Answer

that s the standard way of doing it but you don t really need it

porcellus · Answer

it s between your own microservices so it s your call

Leonxx · Answer

Ok i does work

porcellus · Answer

great

Leonxx · Answer

so it will be cool if you add that to your docs that user don t need to use bearer or the need to cut of that or just include siome function that will cut of that bearer for the user

Leonxx · Answer

Overall I am still learning supertokens and I m pretty happy about that But docs sometimes are not straight forward

porcellus · Answer

any feedback and suggestions are welcome

porcellus · Answer

I m not sure where we d add this advice since we never recommend adding the bearer prefix or offer advice on how you can transport this between microservices I think

porcellus · Answer

ooh right I was looking at the main jwt docs not the microservice specific ones I thought the search function worked across these recipes

porcellus · Answer

I ll open an issue about this in our docs repo or you can open one as well if you d like to track this