Thanks to visit codestin.com
Credit goes to github.com

Skip to content

JWE with no "cty" where content accidentally looks like JSON cannot be decrypted with parseEncryptedContent #1035

@tupelo-schneck

Description

@tupelo-schneck

Describe the bug

If I have a content JWE, and it has no "cty", and the payload content happens to be parseable as JSON, then parseEncryptedContent fails with io.jsonwebtoken.UnsupportedJwtException: Unexpected Claims JWE.

To Reproduce

    Password password = Keys.password("password".toCharArray());
    String jwe = Jwts.builder()
        .content(new byte[] { 0x7B, 0x7D })
        .encryptWith(password, Jwts.KEY.PBES2_HS512_A256KW, Jwts.ENC.A256GCM)
        .compact();
    byte[] payload =  Jwts.parser()
        .decryptWith(password)
        .build()
        .parseEncryptedContent(jwe)
        .getPayload();

This code throws io.jsonwebtoken.UnsupportedJwtException: Unexpected Claims JWE.

Expected behavior

I expect to get the content, which happens to be the two bytes corresponding to the characters '{' and '}'.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions