Perl version of python-jose (Javascript Object Signing and Encryption)?

scorpio17 has asked for the wisdom of the Perl Monks concerning the following question:

I'm trying to decode and verify Amazon Cognito JWT tokens, as described here:
https://github.com/awslabs/aws-support-tools/tree/master/Cognito/decode-verify-jwt

Their example uses python, which depends on a library called python-jose to do the heavy lifting.
I'm trying to do the same thing using Crypt::JWT. My code looks like this:

use strict;
use Crypt::JWT qw(decode_jwt);

my $keylist = '...';
my $token = '...';

my $data = decode_jwt(token=>$token, kid_keys=>$keylist);
[download]

I'm using $keylist and $token values that work in the python script. But in the perl version I'm getting this error:
JWT: exp claim check failed

Is there anything like python-jose for perl?
Am I using Crypt::JWT incorrectly? Is there a better tool for the job?

Comment on Perl version of python-jose (Javascript Object Signing and Encryption)? Download Code

Replies are listed 'Best First'.
Re: Perl version of python-jose (Javascript Object Signing and Encryption)? by tangent (Parson) on Sep 10, 2019 at 23:19 UTC
Looking through the github docs I notice that the payload has an 'exp' attribute (expiration time) which the python script deals with like so: `if time.time() > claims['exp']: print('Token is expired') return False` [download] Using Crypt::JWT you need to specify what to do with 'exp' by passing a value for 'verify_exp': verify_exp undef (default) - Expiration Time 'exp' claim must be valid if present 0 - ignore 'exp' claim 1 - require valid 'exp' claim If the payload has 'exp' and your arguments to decode_jwt() do not contain 'verify_exp' then you get the error you describe. You could try: `my $data = decode_jwt(token=>$token, kid_keys=>$keylist, verify_exp=>1 +);` [download]	[reply] [d/l] [select]
Re^2: Perl version of python-jose (Javascript Object Signing and Encryption)? by scorpio17 (Canon) on Sep 11, 2019 at 12:47 UTC
That was it! The test token had expired, so to ignore that and decode it anyway, I needed verify_exp=>0. I knew I was probably overlooking something simple- thank you so much!	[reply]