JWS verification issues

[DanielGalarza]

Hello,

I recently attempted to migrate to v0.12.3 from v0.11.5 and I ran into some trouble verifying my JWS. I am running this on an Android project:

// version_jjwt is pointing to v0.12.3
api "io.jsonwebtoken:jjwt-api:$version_jjwt"
runtimeOnly "io.jsonwebtoken:jjwt-impl:$version_jjwt"
runtimeOnly("io.jsonwebtoken:jjwt-orgjson:$version_jjwt") {
    exclude group: "org.json", module: "json" //provided by Android natively
}

My code works perfectly fine on v0.11.5 and all I did was update to the suggested functions mentioned in the changelog

My changes include this:

// OLD 0.11.5 code
val publicSpec = getKeySpec(mySecret.pem)
val factory = KeyFactory.getInstance("RSA")
val publicKey = factory.generatePublic(publicSpec) as RSAPublicKey
val sharedSecret = SecretKeySpec(model.sharedSecret?.toByteArray(), SignatureAlgorithm.HS256.jcaName)
val claims =  Jwts.parserBuilder()
                    .setSigningKey(publicKey)
                    .build()
                    .parseClaimsJws(provided)
                    .body

// NEW based on 0.12.0 updates
val publicSpec = getKeySpec(mySecret.pem)
val factory = KeyFactory.getInstance("RSA")
val publicKey = factory.generatePublic(publicSpec) as RSAPublicKey
val sharedSecret = SecretKeySpec(model.sharedSecret?.toByteArray(), Jwts.SIG.HS256.key().build().algorithm)
val claims =  Jwts.parser()
                    .verifyWith(publicKey)
                    .build()
                    .parseSignedClaims(provided) // This is throwing the error log below
                    .payload

Error log:

io.jsonwebtoken.MalformedJwtException: Malformed protected header JSON: Unable to deserialize: No direct method <init>(Ljava/io/Reader;)V in class Lorg/json/JSONTokener; or its super classes (declaration of 'org.json.JSONTokener' appears in /apex/com.android.art/javalib/core-libart.jar)
                                                                                                    	at io.jsonwebtoken.impl.io.JsonObjectDeserializer.malformed(JsonObjectDeserializer.java:76)
                                                                                                    	at io.jsonwebtoken.impl.io.JsonObjectDeserializer.apply(JsonObjectDeserializer.java:70)
                                                                                                    	at io.jsonwebtoken.impl.DefaultJwtParser.deserialize(DefaultJwtParser.java:890)
                                                                                                    	at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:380)
                                                                                                    	at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:362)
                                                                                                    	at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:94)
                                                                                                    	at io.jsonwebtoken.impl.io.AbstractParser.parse(AbstractParser.java:36)
                                                                                                    	at io.jsonwebtoken.impl.io.AbstractParser.parse(AbstractParser.java:29)
                                                                                                    	at io.jsonwebtoken.impl.DefaultJwtParser.parseSignedClaims(DefaultJwtParser.java:821)

Any idea of what I might have missed or what might be happening?

[DanielGalarza]

I also just ran this code from the README quick start example, and I run into the same issue:

// We need a signing key, so we'll create one just for this example. Usually
// the key would be read from your application configuration instead.
val key = Jwts.SIG.HS256.key().build()
val jws = Jwts.builder().subject("Joe").signWith(key).compact()
val claim = Jwts.parser().verifyWith(key).build().parseSignedClaims(jws).payload // causes error

Error:

io.jsonwebtoken.MalformedJwtException: Malformed protected header JSON: Unable to deserialize: No direct method <init>(Ljava/io/Reader;)V in class Lorg/json/JSONTokener; or its super classes (declaration of 'org.json.JSONTokener' appears in /apex/com.android.art/javalib/core-libart.jar)
                                                                                                    	at io.jsonwebtoken.impl.io.JsonObjectDeserializer.malformed(JsonObjectDeserializer.java:76)
                                                                                                    	at io.jsonwebtoken.impl.io.JsonObjectDeserializer.apply(JsonObjectDeserializer.java:70)
                                                                                                    	at io.jsonwebtoken.impl.DefaultJwtParser.deserialize(DefaultJwtParser.java:890)
                                                                                                    	at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:380)
                                                                                                    	at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:362)
                                                                                                    	at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:94)
                                                                                                    	at io.jsonwebtoken.impl.io.AbstractParser.parse(AbstractParser.java:36)
                                                                                                    	at io.jsonwebtoken.impl.io.AbstractParser.parse(AbstractParser.java:29)
                                                                                                    	at io.jsonwebtoken.impl.DefaultJwtParser.parseSignedClaims(DefaultJwtParser.java:821)

[DanielGalarza]

@lhazlewood Please see above

[lhazlewood]

Duplicate of #882 - please do not exclude that dependency until we can get a new release out that avoids this issue. Thanks!

[DanielGalarza]

Unfortunately, this solutions didn't work for me. I didn't exclude the json dependency, but still got the same error