last day (15 days later) » 

7:19 PM
2
A: Golang token validation error

Florent MorselliI send the **decoded** header.payload together with the Google pKey + digest to the rsa function rsa.VerifyPKCS1v15. You are wrong in this part. You must send to the RSA function rsa.VerifyPKCS1v15 the encoded header.payload In another words: you checked the signature of {"alg":"RS256","kid":"d...

 
I've tried your method but without success, I've put update in my question with code example (UPDATE 2)
 
Please can you send me the complete JWS you want to test?
 
do you want over email or?
 
I've sent you token over contact form you gave me
 
7:19 PM
I received your JWS. Thank you. I tried to verify it using my PHP lib and it failed too. I do not think that your code is wrong, it seems that the signature of your token is bad. Can you try to generate a new one?
 
When I paste my token to google endpoint "googleapis.com/oauth2/v1/tokeninfo?id_token=" it decodes it as correct, no errors are returned, so I think the token is correct, maybe it's something wrong with the splitting of the token in my code, or it has to do something with the public key from google certs
 
I was wrong, your JWS are valid (copy/paste error, I am sorry for that). I am still investigating.
 
hi
are you here Florent?
 
I'm here
I am trying to load the certificates in PEM format.
I think that your PublicKey is not valid
 
That could be the problem
How have You concluded that this could be the error?
 
7:36 PM
Because the input (header.payload) and the decoded signature are correct.
Your PublicKey seems to be ok too, but I would like to try using PEM format and not JWK
 
@FLorent
king is my friend who is trying to help me
he is better at this things
@king
can you write?
 
Hi Florent, maybe this is can be helpful: stackoverflow.com/questions/26237283/…
 
great
 
That is the answer I am reading too
really helpful
 
7:54 PM
I put the code from the previous link inside the CroiOS script, but it returnes this error with the token: certInterface: []*x509.Certificate{(*x509.Certificate)(0xc210167480)}
Error verifying key crypto/rsa: verification error#
 
8:13 PM
It is very strange. The hashed message is good, the pKey too
but the verification always fails
 
Maybe the byte value is different, though the string value is correct when checking the token. When I split the token with the "." and decode the header it loses the "}", and i find It also strange.
 
Ok I will try to know why
 
8:34 PM
Yeah OK!
I found the error
thanks a lot king
 
no problem, You're welcome, what was the problem then?
 
@CroiOS I will update your code and explain the problem
stay tuned
if m := len(h) % 4; m != 0 {
    h += strings.Repeat("=", 4-m)
}
this is the magic answer
The base64 url decoder does not support encoded strings withou padding
you just have to add it and you will not lose }
 
I hope that is the solution :)
Please post solution
 
Already done
0
A: Golang token validation error

Florent MorselliAs explained on the chat, the problem is that the Base64 decoder is unable to decode the header and the signature if they are missing "=". You just have to add them with the following code: if m := len(h_) % 4; m != 0 { h_ += strings.Repeat("=", 4-m) } Here is the complete cod...

 
I'll try it tomorrow morning
 
8:45 PM
ok
 
and let you know on stack if it is working
great
 
it works fine for me.
 
great :)
 
do not hesitate to cntact me again if needed
 
good night Florent and king
 
8:46 PM
Good night
 
Good night Florent
 

last day (15 days later) »