Note: Parsing and validation of the JWS should happen only in your backend. Doing the parsing on the client side defeats the purpose of our digital signature
JWS structure
The result is a string representing a JWS Compact Serialization, a representation of the JWS as a compact, URL-safe string, see for details. The decoded JWS is composed of a header that defines the algorithm and the token type and the payload that contains the data.
Note: Parsing and validation of the JWS should happen only in your backend. Doing the parsing on the client side defeats the purpose of our digital signature
The JWS can be validated using the list of public keys available on https://id.uqudo.io/api/.well-known/jwks.json. It is a public endpoint:
Below you can find an example on how to parse and validate the JWS using com.auth0:
import com.auth0.jwk.JwkProvider;
import java.security.Key;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.JwsHeader;
import io.jsonwebtoken.SigningKeyResolver;
public class JwkKeyResolver implements SigningKeyResolver {
private final JwkProvider keyStore;
public JwkKeyResolver(JwkProvider keyStore) {
this.keyStore = keyStore;
}
@Override
public Key resolveSigningKey(JwsHeader header, Claims claims) {
return this.getKey(header);
}
@Override
public Key resolveSigningKey(JwsHeader header, String plaintext) {
return this.getKey(header);
}
private Key getKey(JwsHeader header) throws Exception {
var keyId = header.getKeyId();
return keyStore.get(keyId).getPublicKey();
}
}
Note: Check for the best library you can use according to your environment and programming language. Make sure the libary you choose supports JWKs through URL and make sure it caches the list of keys in memory and refresh the cache only if the kid is not found.
