[OLTU-201] Issue in JWS validation

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: jose-1.0.1
• Component/s: JWT
• Assignee: Antonio Sanso
• Reporter: Antonio Sanso
• Created: 27/Jul/16 12:52
• Updated: 01/Aug/16 16:04
• Resolved: 01/Aug/16 16:04

Description

The JWS validation is currently broken.

The validation fails in certain cases even if the jwt is valid.
The problem is due to some json reordering on reconstructing the jws to validate.
E.g. if the header of the JWS is

 {"kid":"[e-mail]", "alg":"RS256"}

the validation algorithm reconstruct the jws upon validation as

 { "alg":"RS256", "kid":"[e-mail]"}

and consequently the signature would not match any longer