You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@couchdb.apache.org by "lousando (via GitHub)" <gi...@apache.org> on 2026/01/08 22:32:14 UTC
[I] [Bug]: JWT with `"typ": "at+jwt"` fails authentication [couchdb]
lousando opened a new issue, #5838:
URL: https://github.com/apache/couchdb/issues/5838
### Version
3.4.2
### Describe the problem you're encountering
We have a central [Logto](https://logto.io/) OIDC provider that has the ability to add extra claims to the JWT it generates using a [getCustomJwtClaims](https://docs.logto.io/developers/custom-token-claims/create-script) callback the software provides.
Logto is setup to add `_couchdb.roles` to the JWT _before_ it's signed, which is great and we're able to verify that in the decoded JWT body _before_ we send out the encoded + signed version to CouchDB:
```jsonc
// decoded JWT body from Logto with added "_couchdb.roles" claim
{
"_couchdb.roles": [
"premium-user"
],
"sub": "v4zk0po04pk7",
"exp": 1767911186,
// [redacted]
// ..........
}
```
The problem lies that when this signed JWT is sent over to CouchDB, we get the following `500` response:
`{"error":"case_clause","reason":"{undefined,<<\"at+jwt\">>}","ref":799328086}`
What we've narrowed down the issue to seems to be that CouchDB doesn't accept the `at+jwt` value as a JWT header claim for key `typ`.
```jsonc
// decoded header from Logto
{
"alg": "ES384",
"typ": "at+jwt",
"kid": "<a-key-id-by-logto>"
}
```
When we manually sign and send a signed JWT, using Postman, with the same secret key that Logto is using, while also excluding the `typ` header claim, CouchDB successfully authenticates. We found that also setting `"typ": "JWT"` works, while `"typ": "jwt"` fails in the header claims.
We would just overwrite the `typ` header claim in Logto, but they don't allow for that:
https://docs.logto.io/developers/custom-token-claims
> Logto build-in token claims can NOT be overridden or modified. Custom claims will be added to the token as additional claims. If any custom claims conflict with the built-in claims, those custom claims will be ignored.
### Expected Behaviour
A JWT with a header of `typ` of `"at+jwt"` should successfully authenticate.
### Steps to Reproduce
1. Generate an ES384 keypair
2. Configure CouchDB with the public key for JWT authentication
3. Use the private ES384 key to sign a JWT with a header claim of `"typ": "at+jwt"`
4. Use signed JWT to attempt to authenticate with CouchDB
### Your Environment
_No response_
### Additional Context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug]: JWT with `"typ": "at+jwt"` fails authentication [couchdb]
Posted by "rnewson (via GitHub)" <gi...@apache.org>.
rnewson closed issue #5838: [Bug]: JWT with `"typ": "at+jwt"` fails authentication
URL: https://github.com/apache/couchdb/issues/5838
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug]: JWT with `"typ": "at+jwt"` fails authentication [couchdb]
Posted by "lousando (via GitHub)" <gi...@apache.org>.
lousando commented on issue #5838:
URL: https://github.com/apache/couchdb/issues/5838#issuecomment-3726309883
Thanks for the quick response! I wasn't aware of RFC 9068 requiring `at+jwt` validation to be done against the OIDC server.
So, we would need to sign the JWT ourselves with `"typ": "JWT"` at a separate layer then.
Ok, not ideal, but we have a path forward.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug]: JWT with `"typ": "at+jwt"` fails authentication [couchdb]
Posted by "rnewson (via GitHub)" <gi...@apache.org>.
rnewson commented on issue #5838:
URL: https://github.com/apache/couchdb/issues/5838#issuecomment-3726233262
The simple answer is that the at+jwt RFC came out after our JWT implementation and no one has tried such tokens against couchdb before you.
That said, you shouldn't get a case_clause error. The bug is here https://github.com/apache/couchdb/blob/main/src/jwtf/src/jwtf.erl#L177. That line should read `{_, _}` instead, and that way we'd return a sensible error message.
There are two principles in the jwtf application to note here:
1) the _administrator_ can decide which claims are required to be in presented tokens.
2) _couchdb_ insists that all presented claims are valid, regardless of whether they are required. The latter requirement is a security precaution; not to accept malformed tokens.
Adding support for RFC 9068 looks like it's more than merely allowing `typ` to be `at+jwt` so this is an enhancement rather than a bug fix (we should fix the bug I mentioned in the second para though): https://www.rfc-editor.org/rfc/rfc9068.html#name-validating-jwt-access-token.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@couchdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org