django - 修复 : InvalidAlgorithmError: The specified alg value is not allowed while trying to decode encoded jwt token in Python

Question

我正在尝试解码从授权服务收到的 token 。问题是当我尝试解码它时，我得到 InvalidAlgorithmError: the specified alg value is not allowed .

当你看下面的图片时。我可以从 解码 token jwt.io 站点并查看有效负载。

我正在使用 PyJwt图书馆。您将在下面找到我的实现。

jwt.io 站点中的解码 token



实现

import jwt 

    encoded = "eyJhbGciOiJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNobWFjLXNoYTI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvY2xhaW1zL3JvbGUiOiJERVZFTE9QRVIiLCJ1c2VyZnVsbG5hbWUiOiJFcmljIE0gS2FyaW1pIiwidXNlcm5hbWUiOiJlcmljIiwidXNlcmlkIjoiMjkiLCJleHAiOjE1NzM0ODE0MzIsImlzcyI6IkVyaWMiLCJhdWQiOiJSZWFkZXJzIn0.tTQckIZGYNHE667NXrxT4YwT4DNZ01u3P3b3IMFyWR4"

    key = "somekeyrequiredtodecode"

    decoded = jwt.decode(encoded,key, algorithms=['HS256'])  

完整堆栈跟踪

~/Desktop/APIs/ncc-api/env/lib/python3.6/site-packages/jwt/api_jws.py in decode(self, jwt, key, verify, algorithms, options, **kwargs)
    154         elif verify_signature:
    155             self._verify_signature(payload, signing_input, header, signature,
--> 156                                    key, algorithms)
    157 
    158         return payload

~/Desktop/APIs/ncc-api/env/lib/python3.6/site-packages/jwt/api_jws.py in _verify_signature(self, payload, signing_input, header, signature, key, algorithms)
    214 
    215         if algorithms is not None and alg not in algorithms:
--> 216             raise InvalidAlgorithmError('The specified alg value is not allowed')
    217 
    218         try:

InvalidAlgorithmError: The specified alg value is not allowed

In [7]: v = jwt.decode(key, s, algorithms=['HS256'])                                                                                                                                                          
---------------------------------------------------------------------------
InvalidAlgorithmError                     Traceback (most recent call last)
<ipython-input-7-a9465dfcaa4b> in <module>
----> 1 v = jwt.decode(key, s, algorithms=['HS256'])

~/Desktop/APIs/ncc-api/env/lib/python3.6/site-packages/jwt/api_jwt.py in decode(self, jwt, key, verify, algorithms, options, **kwargs)
     90 
     91         decoded = super(PyJWT, self).decode(
---> 92             jwt, key=key, algorithms=algorithms, options=options, **kwargs
     93         )
     94 

~/Desktop/APIs/ncc-api/env/lib/python3.6/site-packages/jwt/api_jws.py in decode(self, jwt, key, verify, algorithms, options, **kwargs)
    154         elif verify_signature:
    155             self._verify_signature(payload, signing_input, header, signature,
--> 156                                    key, algorithms)
    157 
    158         return payload

~/Desktop/APIs/ncc-api/env/lib/python3.6/site-packages/jwt/api_jws.py in _verify_signature(self, payload, signing_input, header, signature, key, algorithms)
    214 
    215         if algorithms is not None and alg not in algorithms:
--> 216             raise InvalidAlgorithmError('The specified alg value is not allowed')
    217 
    218         try:
InvalidAlgorithmError: The specified alg value is not allowed

Answer 1

在某些(不推荐)情况下，您不需要验证签名。
如果是这种情况，请使用:

jwt.decode(encoded_str, options={"verify_signature": False})

https://pyjwt.readthedocs.io/en/stable/usage.html#reading-the-claimset-without-validation