Golang令牌验证错误

Question

Golang令牌验证错误

iWi*_*ard 1 rsa go oauth-2.0 jwt google-oauth

我需要验证谷歌id_token,一步涉及检查令牌签名.

首先,我从以下网址获取证书:https://www.googleapis.com/oauth2/v2/certs并从证书中提取模数(n)和指数(e)部分并生成公钥,然后我拆开令牌(标题,有效负载和摘要),然后我将解码header.payload与谷歌pKey +摘要一起发送到rsa函数rsa.VerifyPKCS1v15.

我遇到了这个验证错误: crypto/rsa: verification error

这是代码(我评论了失败的部分代码// validation here fails):

func ValidateIDToken(auth_token string) (err error){    
    res, err := http.Get("https://www.googleapis.com/oauth2/v2/certs")
    if err != nil {
        log.Fatal(err)
        return err
    }

    certs, err := ioutil.ReadAll(res.Body)
    res.Body.Close()
    if err != nil {
        log.Fatal(err)
        return err
    }

    //get modulus and exponent from the cert
    var goCertificate interface{}

    err = json.Unmarshal(certs, &goCertificate)    
    k := goCertificate.(map[string]interface{})["keys"]
    j := k.([]interface{})
    x := j[1]
    h := x.(map[string]interface{})["n"]
    g := x.(map[string]interface{})["e"]
    e64 := base64.StdEncoding
    //build the google pub key
    nStr := h.(string)
    decN, err := base64.StdEncoding.DecodeString(nStr)
    if err != nil {
        log.Println(err)
        return
    }

    n := big.NewInt(0)
    n.SetBytes(decN)
    eStr := g.(string)
    decE, err := base64.StdEncoding.DecodeString(eStr)
    if err != nil {
        log.Println(err)
        return
    }

    var eBytes []byte
    if len(decE) < 8 {
        eBytes = make([]byte, 8-len(decE), 8)
        eBytes = append(eBytes, decE...)
    } else {
        eBytes = decE
    }

    eReader := bytes.NewReader(eBytes)
    var e uint64
    err = binary.Read(eReader, binary.BigEndian, &e)
    if err != nil {
        log.Println(err)
        return
    }

    pKey := rsa.PublicKey{N: n, E: int(e)}
    w := strings.SplitAfter(auth_token, ".")    
    for i, val := range w {
        w[i] = strings.Trim(val, ".")
    }
    y := w[0:2]

    //Join just the first two parts, the header and the payload without the signature
    o := strings.Join(y, ".")   
    headerOauth := DecodeB64(nil,[]byte(w[0]),e64)
    inblockOauth := DecodeB64(nil,[]byte(w[1]),e64)
    toHash := string(headerOauth) + "}." + string(inblockOauth)
    digestOauth := DecodeB64(nil, []byte(w[2]),e64)

    hasherOauth := sha256.New()
    hasherOauth.Write([]byte(toHash))

    // validation here fails
    err = rsa.VerifyPKCS1v15(&pKey,crypto.SHA256,hasherOauth.Sum(nil),digestOauth)

    if err != nil {
        log.Printf("Error verifying key %s",err.Error())
        return err
    }
    return err
}

Run Code Online (Sandbox Code Playgroud)

更新1: 这是包含头和有效负载的哈希var:

{"alg":"RS256","kid":"d91c503452d0f8849200a321ffbf7dea76f9371d"}.{"iss":"accounts.google.com","sub":"104869993929250743503","azp":"client_email_till_@.apps.googleusercontent.com","email":"test@test.hr","at_hash":"KAm1M0g-ssMkdjds7jkbVQ","email_verified":true,"aud":client_email_till_@.apps.googleusercontent.com","hd":"test.hr","iat":1412246551,"exp":1412250451}

Run Code Online (Sandbox Code Playgroud)

更新2: 感谢@Florent Morselli的回复,我再次尝试了它失败了,我这次B64解码只有第三部分(签名)但错误仍然存在,有人用他们的auth_token测试它,只需要放置ID令牌在代码下面的auth_token变量中,让我知道它是否有效,谢谢.

package main
import(
    "strings"
    "encoding/binary"
    "errors"
    "fmt"
    "log"
    "encoding/base64"
    "io/ioutil"
    "crypto"    
    "crypto/sha256"
    "crypto/rsa"
    "bytes"
    "encoding/json"
    "net/http"
    "math/big"  

)

func main() {
    auth_token := ""
    w := strings.SplitAfter(auth_token, ".")    
    for i, val := range w {
        w[i] = strings.Trim(val, ".")
    }
    headerOauth, err := base64.URLEncoding.DecodeString(w[0])

    res, err := http.Get("https://www.googleapis.com/oauth2/v2/certs")
    if err != nil {
        fmt.Println(err)
    }

    certs, err := ioutil.ReadAll(res.Body)
    res.Body.Close()
    if err != nil {
        fmt.Println(err)
    }

    //extract kid from token header
    var header interface{}

    err = json.Unmarshal([]byte(string(headerOauth)+"}"), &header)

    token_kid := header.(map[string]interface{})["kid"]
    fmt.Println("By 1")
    //get modulus and exponent from the cert

    var goCertificate interface{}

    err = json.Unmarshal(certs, &goCertificate)    

    //k := goCertificate.(map[string]interface{})[token_kid.(string)]
    k := goCertificate.(map[string]interface{})["keys"]

    ///*mod & exp part
    j := k.([]interface{})
    x := j[0]

    if j[0].(map[string]interface{})["kid"] == token_kid {
        x = j[0]
    }else{
        if j[1].(map[string]interface{})["kid"] == token_kid {
            x = j[1]
        }else{
            errors.New("Token is not valid, kid from token and certificate don't match")

        }
    }
    h := x.(map[string]interface{})["n"]
    g := x.(map[string]interface{})["e"]

    //build the google pub key
    nStr := h.(string)
    decN, err := base64.URLEncoding.DecodeString(nStr)
    if err != nil {
        fmt.Println(err)
        return
    }

    n := big.NewInt(0)
    n.SetBytes(decN)
    eStr := g.(string)
    decE, err := base64.URLEncoding.DecodeString(eStr)
    if err != nil {
        fmt.Println(err)
        return
    }

    var eBytes []byte
    if len(decE) < 8 {
        eBytes = make([]byte, 8-len(decE), 8)
        eBytes = append(eBytes, decE...)
    } else {
        eBytes = decE
    }

    eReader := bytes.NewReader(eBytes)
    var e uint64
    err = binary.Read(eReader, binary.BigEndian, &e)
    if err != nil {
        log.Println(err)
        return
    }

    pKey := rsa.PublicKey{N: n, E: int(e)}
        //inblockOauth := base64.URLEncoding.DecodeString(w[1])
    toHash := w[0] + "." + w[1]
    digestOauth, err := base64.URLEncoding.DecodeString(w[2])

    hasherOauth := sha256.New()
    hasherOauth.Write([]byte(toHash))

    // verification here fails
    err = rsa.VerifyPKCS1v15(&pKey,crypto.SHA256,hasherOauth.Sum(nil),digestOauth)

    if err != nil {
        fmt.Printf("Error verifying key %s",err.Error())

    }

}

Run Code Online (Sandbox Code Playgroud)

Answer 1

Flo*_*lli 5

正如聊天中所解释的那样,问题是Base64解码器如果缺少"="则无法解码标头和签名.

您只需使用以下代码添加它们:

    if m := len(h_) % 4; m != 0 {
        h_ += strings.Repeat("=", 4-m)
    }

Run Code Online (Sandbox Code Playgroud)

这是完整的代码:

package main
import(
    "strings"
    "encoding/binary"
    "errors"
    "fmt"
    "log"
    "encoding/base64"
    "io/ioutil"
    "crypto"    
    "crypto/sha256"
    "crypto/rsa"
    "bytes"
    "encoding/json"
    "net/http"
    "math/big"  

)

func main() {
    auth_token := ""
    w := strings.Split(auth_token, ".")    
    h_, s_ := w[0], w[2]

    if m := len(h_) % 4; m != 0 {
        h_ += strings.Repeat("=", 4-m)
    }
    if m := len(s_) % 4; m != 0 {
        s_ += strings.Repeat("=", 4-m)
    }

    headerOauth, err := base64.URLEncoding.DecodeString(h_)

    res, err := http.Get("https://www.googleapis.com/oauth2/v2/certs")
    if err != nil {
        fmt.Println(err)
    }

    certs, err := ioutil.ReadAll(res.Body)
    res.Body.Close()
    if err != nil {
        fmt.Println(err)
    }

    //extract kid from token header
    var header interface{}

    err = json.Unmarshal([]byte(string(headerOauth)), &header)

    token_kid := header.(map[string]interface{})["kid"]
    fmt.Println("By 1")
    //get modulus and exponent from the cert

    var goCertificate interface{}

    err = json.Unmarshal(certs, &goCertificate)    

    //k := goCertificate.(map[string]interface{})[token_kid.(string)]
    k := goCertificate.(map[string]interface{})["keys"]

    ///*mod & exp part
    j := k.([]interface{})
    x := j[0]

    if j[0].(map[string]interface{})["kid"] == token_kid {
        x = j[0]
    }else{
        if j[1].(map[string]interface{})["kid"] == token_kid {
            x = j[1]
        }else{
            errors.New("Token is not valid, kid from token and certificate don't match")

        }
    }
    h := x.(map[string]interface{})["n"]
    g := x.(map[string]interface{})["e"]

    //build the google pub key
    nStr := h.(string)
    decN, err := base64.URLEncoding.DecodeString(nStr)
    if err != nil {
        fmt.Println(err)
        return
    }

    n := big.NewInt(0)
    n.SetBytes(decN)
    eStr := g.(string)
    decE, err := base64.URLEncoding.DecodeString(eStr)
    if err != nil {
        fmt.Println(err)
        return
    }

    var eBytes []byte
    if len(decE) < 8 {
        eBytes = make([]byte, 8-len(decE), 8)
        eBytes = append(eBytes, decE...)
    } else {
        eBytes = decE
    }

    eReader := bytes.NewReader(eBytes)
    var e uint64
    err = binary.Read(eReader, binary.BigEndian, &e)
    if err != nil {
        log.Println(err)
        return
    }

    pKey := rsa.PublicKey{N: n, E: int(e)}
        //inblockOauth := base64.URLEncoding.DecodeString(w[1])
    toHash := w[0] + "." + w[1]
    digestOauth, err := base64.URLEncoding.DecodeString(s_)

    hasherOauth := sha256.New()
    hasherOauth.Write([]byte(toHash))

    // verification of the signature
    err = rsa.VerifyPKCS1v15(&pKey,crypto.SHA256,hasherOauth.Sum(nil),digestOauth)


    if err != nil {
        fmt.Printf("Error verifying key %s",err.Error())
    }
    fmt.Printf("OK!")
}

Run Code Online (Sandbox Code Playgroud)

归档时间：	10 年，11 月前
查看次数：	2212 次
最近记录：	10 年，11 月前