为什么来自Amazon Cognito的JWT Token'的签名无效？

Question

我正在研究亚马逊认知.我想从https://jwt.io解码

eyJraWQiOiJRaGF4STZGbXB5Y3Z3dUV5TUZJUk9FTm5MTDJKTiswMzVVak5MNTEycjZvPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJhYjI0YzExYS1mNjZhLTRjMjktOWVhNy0yMWQwMTc2NmZlN2IiLCJhdWQiOiIxY2ZxNjJubjNlZmNpdWFpYnFldmlxbHU4OSIsInRva2VuX3VzZSI6ImlkIiwiYXV0aF90aW1lIjoxNDk0Njg1MjQwLCJpc3MiOiJodHRwczpcL1wvY29nbml0by1pZHAudXMtZWFzdC0xLmFtYXpvbmF3cy5jb21cL3VzLWVhc3QtMV9oM3F4WGVPQzQiLCJjb2duaXRvOnVzZXJuYW1lIjoidGVzdHNhbmRlZXAxIiwiZXhwIjoxNDk0Njg4ODQwLCJpYXQiOjE0OTQ2ODUyNDAsImVtYWlsIjoic2FuZGVlcC5qYWtrYXJhanVAZm9jYWxjeG0uY29tIn0.ZRsYZZwxUnqL4FfuWhD-w8xQWoQQkuj4rYCYPqQehcq1SMe0Vww2GIY4-sr9RgwjVxhOo4WqIQT8LzSn_tFBF504h5xGpp5fD37rIJZ49rC3naH7tC0nHwKSswi6C6x8BlIPi4QAnlP49SZMoIEPEnQig9F6wzlDfb-cjw0R2q61Em-e0cpBM8lbjxCrgBF2-PbXFqwEfncEUkwb93qZHo4Wk3pYH3d-9aXzZg6Xc4CNZfehAUZ7qknq2qtaSI3tH-EXGYmytjoVwcF5jIvej2OATrQf_JbfBNSxC96oA_CglWVKvp2rPrqlZzDCd0Se68TjZvKSbW7XtKX_DzI5ww

它说签名无效.我尝试了许多令牌,我总是得到这个.

为什么报告签名无效？

Answer 1

@jps是正确的.您需要先下载Cognito用户池的JWK,然后才能验证JWT的签名.

1. 下载您的Cognito用户池JWK文件:https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/jwks.json.对于您的用户池,这是:https://cognito-idp.us-east-1.amazonaws.com/us-east-1_h3qxXeOC4/.well-known/jwks.json
2. 找到您的身份kid值.您提供的令牌的值是:"QhaxI6FmpycvwuEyMFIROENnLL2JN+035UjNL512r6o=".
3. 然后,您需要生成与JWKs文件提供的数据匹配的kid公钥,该公钥与您的密钥匹配.这是博客:https://aws.amazon.com/blogs/mobile/integrating-amazon-cognito-user-pools-with-api-gateway/(进一步了解博客文章,了解如何生成公钥).