fix: pass JWK for singing so that KeyID is set in JWTs (#799)

ory · Sep 16, 2024 · 11cc702 · 11cc702
1 parent aa7c79e
commit 11cc702
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 3 deletions.
diff --git a/token/jwt/jwt.go b/token/jwt/jwt.go
@@ -48,9 +48,9 @@ func (j *DefaultSigner) Generate(ctx context.Context, claims MapClaims, header M
 
 	switch t := key.(type) {
 	case *jose.JSONWebKey:
-		return generateToken(claims, header, jose.SignatureAlgorithm(t.Algorithm), t.Key)
+		return generateToken(claims, header, jose.SignatureAlgorithm(t.Algorithm), t)
 	case jose.JSONWebKey:
-		return generateToken(claims, header, jose.SignatureAlgorithm(t.Algorithm), t.Key)
+		return generateToken(claims, header, jose.SignatureAlgorithm(t.Algorithm), t)
 	case *rsa.PrivateKey:
 		return generateToken(claims, header, jose.RS256, t)
 	case *ecdsa.PrivateKey:

diff --git a/token/jwt/jwt_test.go b/token/jwt/jwt_test.go
@@ -105,6 +105,7 @@ func TestGenerateJWT(t *testing.T) {
 			},
 			resetKey: func(strategy Signer) {
 				key = &jose.JSONWebKey{
+					KeyID:     "test-id",
 					Key:       gen.MustES521Key(),
 					Algorithm: "ES512",
 				}
@@ -129,7 +130,16 @@ func TestGenerateJWT(t *testing.T) {
 
 			token, sig, err := tc.strategy.Generate(context.TODO(), claims.ToMapClaims(), header)
 			require.NoError(t, err)
-			require.NotNil(t, token)
+			require.NotEmpty(t, token)
+			require.NotEmpty(t, sig)
+
+			decoded, err := tc.strategy.Decode(context.TODO(), token)
+			require.NoError(t, err)
+			require.NotNil(t, decoded)
+
+			if k, ok := key.(*jose.JSONWebKey); ok && k.KeyID != "" {
+				require.Equal(t, k.KeyID, decoded.Header["kid"])
+			}
 
 			sig, err = tc.strategy.Validate(context.TODO(), token)
 			require.NoError(t, err)