IBM/node-sdk-core

Error after 4.0.1 release -JsonWebTokenError: secret or public key must be provided

NickVanderPyle opened this issue · 5 comments

NickVanderPyle commented

Started getting this error after 4.0.1 was released. Error was not present with 4.0.0.
App has a direct dependency on latest @ibm-cloud/platform-services which has a dependency on this project.

Error: JsonWebTokenError: secret or public key must be provided
    at IamTokenManager.JwtTokenManager.saveTokenInfo (/app/node_modules/ibm-cloud-sdk-core/auth/token-managers/jwt-token-manager.js:111:19)
    at IamTokenManager.IamRequestBasedTokenManager.saveTokenInfo (/app/node_modules/ibm-cloud-sdk-core/auth/token-managers/iam-request-based-token-manager.js:137:40)
    at /app/node_modules/ibm-cloud-sdk-core/auth/token-managers/token-manager.js:109:19
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (internal/process/task_queues.js:95:5)
dpopp07 commented

This seems to be happening because the IAM service is returning JWTs with invalid signatures, which the previous (and insecure) version of jsonwebtoken was fine with. 4.0.1 pushed a security fix that is causing this logic to fail. I'm going to see if there is a workaround or something we need to fix on our end

  • 👍3
TannerS commented

Just reading " IAM service is returning JWTs with invalid signatures" sounds suspicious lol

dpopp07 commented

Just reading " IAM service is returning JWTs with invalid signatures" sounds suspicious lol

Agreed, but I may have misinterpreted something. I need to follow up with the IAM folks on this. It seems that having the user configure a public key is not a typical part of the workflow but JWT "verify" requires the client perform validation on the token with a public key to ensure it matches the key used to create the token.

All that said, we were never using the JWT package for client-side validation, only to decode the token to determine the expiration time, etc. So reverting back to the old "decode" logic should be fine, which I did in this PR.

I misunderstood the motivation to migrate to "verify" and didn't test it well enough, so I apologize for the inconvenience this caused. It should be resolved shortly!

TannerS commented
  • 👍1
dpopp07 commented

Resolved with #227