A public key is the openly distributable half of an asymmetric cryptographic key pair. The private key signs data, while the public key validates signatures without revealing the signing secret. section 8.2 section 8.3
Use public keys to keep verification separate from signing:
- Generate a paired RSA private key and public key for asymmetric JWT signing. section 8.2
- Keep the private key for token issuance and provide the public key to validators. section 8.2 section 8.3
- Restrict accepted algorithms explicitly so attackers cannot turn public-key validation into an algorithm-confusion attack. section 8.3
Validating a PS256 JWT
Load public_key.pem with load_pem_public_key(), then pass the resulting key to PyJWT’s decode() with algorithms=["PS256"], the expected audience, and the expected issuer. Successful validation returns the payload; failure raises an exception. section 8.3
Listing 8.8 Validating tokens with a PS256 signature
# file: ch08/jwt_validator_pyjwt_ps256.py
from pathlib import Path
import jwt
from cryptography.hazmat.primitives.serialization \
import load_pem_public_key
public_key = load_pem_public_key( #1
Path("public_key.pem").read_text().encode()
)
def validate_token(token):
return jwt.decode(
jwt=token,
key=public_key, #2
algorithms=["PS256"], #3
audience="https://apithreats.com/api",
issuer="https://auth.apithreats.com",
)
token = <token>
print(validate_token(token))
The focused listing shows how a validator loads a PEM-encoded public key and uses it with an explicit PS256 algorithm. section 8.3
