Skip to content

[Bug] For JWE, JsonWebTokenHandler.ValidateJWEAsync does not consider the decrypt keys in the configuration #2737

@jmprieur

Description

@jmprieur

Which version of Microsoft.IdentityModel are you using?
8.0.0

Where is the issue?

  • [ x] M.IM.JsonWebTokens

Is this a new or an existing app?
App trying to use decrypt keys from the OIDC configuration

Repro

var your = (code) => here;

Expected behavior
If the key from the JWE token is not present in the TokenValidationParameters, attempt to use the decrypt keys in the configuration

Actual behavior
the configuration is not attempted as it's not passed to DecryptToken

TokenValidationResult tokenValidationResult = ReadToken(DecryptToken(jwtToken, validationParameters), validationParameters);

Possible solution
Use the right override of DecryptToken from that accepts the configuration

- TokenValidationResult tokenValidationResult = ReadToken(DecryptToken(jwtToken, validationParameters), validationParameters);
+ TokenValidationResult tokenValidationResult = ReadToken(DecryptToken(jwtToken, validationParameters, configuration), validationParameters);

Used for auto-decrypt

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugProduct is not functioning as expected

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions