驗證的NodeJS JWT令牌從.NET失敗

Question

我這個C＃代碼（與System.IdentityModel.Tokens.Jwt）從.NET創建令牌：

var keybytes = Convert.FromBase64String("MYCUSTOMCODELONGMOD4NEEDBEZE"); 
var signingCredentials = new SigningCredentials(

new InMemorySymmetricSecurityKey(keybytes), 
SecurityAlgorithms.HmacSha256Signature, 
SecurityAlgorithms.Sha256Digest); 
var nbf = DateTime.UtcNow.AddDays(-100); 
var exp = DateTime.UtcNow.AddDays(100); 
var payload = new JwtPayload(null, "", new List<Claim>(), nbf, exp); 
var user = new Dictionary<string, object>(); 
user.Add("userId", "1"); 

payload.Add("user", user); 
payload.Add("success", true); 
var jwtToken = new JwtSecurityToken(new JwtHeader(signingCredentials), payload); 
var jwtTokenHandler = new JwtSecurityTokenHandler(); 
var resultToken = jwtTokenHandler.WriteToken(jwtToken); 

我送resultToken以和的NodeJS驗證（使用jsonwebtoken庫）用以下代碼：

var jwt = require('jsonwebtoken'); 

var result = jwt.verify(
    resultToken, 
    new Buffer('MYCUSTOMCODELONGMOD4NEEDBEZE').toString('base64'), 
    { algorithms: ['HS256'] }, 
    function(err, decoded) { 
    if (err) { 
    console.log('decode token failed with error: '+ JSON.stringify(err)); 
    } 
    } 
); 

我得到了錯誤：無效簽名。該resultToken內容：

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0OTQ4MTMxMTUsIm5iZiI6MTQ3NzUzMzExNSwidXNlciI6eyJ1c2VySWQiOiIxIn0sInN1Y2Nlc3MiOnRydWV9.4bjYyIUFMouz-ctFyxXkJ_QcJJQofCEFffUuazWFjGw 

我調試它jwt.io上面簽名（MYCUSTOMCODELONGMOD4NEEDBEZE）和祕密的Base64編碼的檢查，它的確定。

我已經嘗試了簽名，而不在C＃代碼換款keybytes base64編碼：

var keybytes = Encoding.UTF8.GetBytes("MYCUSTOMCODELONGMOD4NEEDBEZE"); 

而且它成功的NodeJS驗證。所以我認爲在驗證base64編碼簽名時，問題來自我的nodejs代碼。驗證令牌或某些東西時，我是否錯過了一些選項？

Answer 1

我不知道你做了什麼，但是這段代碼正在爲你處理上面提供的令牌。

var jwt = require('jwt-simple') 

var secret = new Buffer('MYCUSTOMCODELONGMOD4NEEDBEZE').toString('base64') 
var token = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0OTQ4MTMxMTUsIm5iZiI6MTQ3NzUzMzExNSwidXNlciI6eyJ1c2VySWQiOiIxIn0sInN1Y2Nlc3MiOnRydWV9.4bjYyIUFMouz-ctFyxXkJ_QcJJQofCEFffUuazWFjGw' 

var decoded = jwt.decode(token, secret) 
console.log(decoded) 

輸出：

❯ node jwt.js 
{ exp: 1494813115, 
    nbf: 1477533115, 
    user: { userId: '1' }, 
    success: true }  

使用jsonwebtoken庫

// var jwt = require('jwt-simple') 

var jwt = require('jsonwebtoken'); 
var secret = Buffer.from('MYCUSTOMCODELONGMOD4NEEDBEZE', 'base64') 
var token = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0OTQ4MTMxMTUsIm5iZiI6MTQ3NzUzMzExNSwidXNlciI6eyJ1c2VySWQiOiIxIn0sInN1Y2Nlc3MiOnRydWV9.4bjYyIUFMouz-ctFyxXkJ_QcJJQofCEFffUuazWFjGw' 

jwt.verify(token, secret, { algorithms: ['HS256'] }, function(err, decoded) { 
    if (err) { 
     console.log(err) 
    } else { 
     console.log(decoded)  
    } 
}) 

再次還在工作的罰款。

我能看到的唯一區別就是祕密。