How to decode an encrypted json web token

[Ronnald Baque]

Hello everyone,

I am trying to decode an encrypted JWT but have not been successful. I have tried the Decode Json Web Token assertion, it performs the decoding when I pass it a signed JWT but when the JWT is encrypted the assertion fails.





Any help is good to have lights since I am stuck there.


Best regards,

Ronald.

[Jay MacDonald]

How was it encrypted and to what key? Per the documentation (https://techdocs.broadcom.com/us/en/ca-enterprise-software/layer7-api-management/api-gateway/10-0/policy-assertions/assertion-palette/message-validation-transformation-assertions/decode-json-web-token-assertion.html):

For a nested JWT (both signed and encrypted), use one Decode JSON Web Token assertion to decrypt, then pass the resulting payload ${<prefix>.plaintext} to a second Decode JSON Web Token assertion.

So you must first decrypt the JWE then run it through the decode again to validate the JWS. I'm attaching a sample policy to illustrate this that creates a signed and encrypted JWT then decrypts and validates.

------------------------------
Jay MacDonald - Adoption Architect - Broadcom API Management (Layer 7)
------------------------------

Attachment(s)

JWT-JWS-JWE.xml   4 KB 1 version

[Robbert vanBeveren]

Hi Ronald

Have you had a look at the JWTGrok article and code Jay MacDonald published in the community in late Feb 2021?

"Understanding JOSE and JWK in the API Gateway with JWE and JWS test cases" 

The stuff in there sorted things out for me when it came to dealing with encoded JWTs.

Cheers


------------------------------
Robbert van Beveren
Solution Architect
HCL Technologies
United Kingdom
------------------------------