修复：InvalidAlgorithmError：尝试在 Python 中解码编码的 jwt 令牌时不允许指定的 alg 值

Question

我正在尝试解码从授权服务收到的令牌。问题是当我尝试解码它时，我得到InvalidAlgorithmError: the specified alg value is not allowed.

当你看下面的图片时。我可以从jwt.io站点解码令牌并查看有效负载。

我正在使用PyJwt库。您将在下面找到我的实现。

jwt.io 站点中的解码令牌

执行

import jwt 

    encoded = "eyJhbGciOiJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNobWFjLXNoYTI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvY2xhaW1zL3JvbGUiOiJERVZFTE9QRVIiLCJ1c2VyZnVsbG5hbWUiOiJFcmljIE0gS2FyaW1pIiwidXNlcm5hbWUiOiJlcmljIiwidXNlcmlkIjoiMjkiLCJleHAiOjE1NzM0ODE0MzIsImlzcyI6IkVyaWMiLCJhdWQiOiJSZWFkZXJzIn0.tTQckIZGYNHE667NXrxT4YwT4DNZ01u3P3b3IMFyWR4"

    key = "somekeyrequiredtodecode"

    decoded = jwt.decode(encoded,key, algorithms=['HS256'])  

完整堆栈跟踪

~/Desktop/APIs/ncc-api/env/lib/python3.6/site-packages/jwt/api_jws.py in decode(self, jwt, key, verify, algorithms, options, **kwargs)
    154         elif verify_signature:
    155             self._verify_signature(payload, signing_input, header, signature,
--> 156                                    key, algorithms)
    157 
    158         return payload

~/Desktop/APIs/ncc-api/env/lib/python3.6/site-packages/jwt/api_jws.py in _verify_signature(self, payload, signing_input, header, signature, key, algorithms)
    214 
    215         if algorithms is not None and alg not in algorithms:
--> 216             raise InvalidAlgorithmError('The specified alg value is not allowed')
    217 
    218         try:

InvalidAlgorithmError: The specified alg value is not allowed

In [7]: v = jwt.decode(key, s, algorithms=['HS256'])                                                                                                                                                          
---------------------------------------------------------------------------
InvalidAlgorithmError                     Traceback (most recent call last)
<ipython-input-7-a9465dfcaa4b> in <module>
----> 1 v = jwt.decode(key, s, algorithms=['HS256'])

~/Desktop/APIs/ncc-api/env/lib/python3.6/site-packages/jwt/api_jwt.py in decode(self, jwt, key, verify, algorithms, options, **kwargs)
     90 
     91         decoded = super(PyJWT, self).decode(
---> 92             jwt, key=key, algorithms=algorithms, options=options, **kwargs
     93         )
     94 

~/Desktop/APIs/ncc-api/env/lib/python3.6/site-packages/jwt/api_jws.py in decode(self, jwt, key, verify, algorithms, options, **kwargs)
    154         elif verify_signature:
    155             self._verify_signature(payload, signing_input, header, signature,
--> 156                                    key, algorithms)
    157 
    158         return payload

~/Desktop/APIs/ncc-api/env/lib/python3.6/site-packages/jwt/api_jws.py in _verify_signature(self, payload, signing_input, header, signature, key, algorithms)
    214 
    215         if algorithms is not None and alg not in algorithms:
--> 216             raise InvalidAlgorithmError('The specified alg value is not allowed')
    217 
    218         try:
InvalidAlgorithmError: The specified alg value is not allowed

Answer 1

标头中指定的算法对于库来说不是有效的。{ "alg": "HS256"}如果您想使用这些进行解码，则需要对 JWT 进行编码。

您可以检查支持的算法：

from jwt.algorithms import get_default_algorithms

get_default_algorithms()

Answer 2

在某些（不推荐）情况下，您不需要验证签名。如果是这种情况，请使用：

jwt.decode(encoded_str, options={"verify_signature": False})

https://pyjwt.readthedocs.io/en/stable/usage.html#reading-the-claimset-without-validation