Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>From the specification point of view, what you are encountering is [OpenID Connect]. </p> <p>id_token is a [JWS] signed [JWT]. In this case, it is a "." separated string with three components. The first portion is the header. The second is the payload. The third is the signature. Each of them are Base64url encoded string. </p> <p>When you decode the header, you will get something like: </p> <p>{"alg":"RS256","kid":"43ebb53b0397e7aaf3087d6844e37d55c5fb1b67"}</p> <p>The "alg" indicates that the signature algorithm is RS256, which is defined in [JWA]. The "kid" indicates the key id of the public key that corresponds to the key used to sign. </p> <p>Now I am ready to answer some of your questions: </p> <blockquote> <p>2: How will I know when I need to pull in a fresh version of it? </p> </blockquote> <p>When the kid of the cached cert file (a [JWK] file) does not match the kid in the header, fetch a new cert file. (BTW, the URL from which you pull the certs are called x5u.) </p> <blockquote> <p>3: It seems like passing in true for noVerify (3rd arg in jwt.decode) is a terrible idea. How can I get that to work without passing that in?</p> </blockquote> <p>Indeed. Perhaps you might want to look at another library such as kjur.github.io/jsjws/ . </p> <p><strong>References</strong></p> <ul> <li>[OpenID Connect] openid.bitbucket.org/openid-connect-core-1_0.html</li> <li>[JWS] tools.ietf.org/html/draft-ietf-jose-json-web-signature</li> <li>[JWT] tools.ietf.org/html/draft-ietf-oauth-json-web-token‎</li> <li>[JWK] tools.ietf.org/html/draft-ietf-oauth-json-web-keys</li> <li>[JWA] tools.ietf.org/html/draft-ietf-jose-json-web-algorithms</li> </ul>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload