Getting Invalid JWE error

[saoodahmad]

Expected behaviour
decoded payload

Environment:
"jose": "4.4.0",

node version:
v14.x

Issue :

Hello @panva , I am getting an "ERR_JWE_INVALID" error when decoding the encrypted jwt using the below snippet of code

// for creating and encrypting jwt

function createtoken (data) {
  return new Promise(async (resolve, reject) => {
    try {
      const publicPem = await readFile('./public.pem');
      const publicKey = await jose.importSPKI(publicPem.toString(), 'RSA-OAEP');

      const token = await new jose.EncryptJWT(data)
        .setProtectedHeader({ alg: 'RSA-OAEP', enc: 'A256CBC-HS512' })
        .encrypt(publicKey);
      resolve(token);
    } catch (error) {
      reject(error);
    }
  });
}

// for decrypting the jwt

function decode(token) {
  
  return new Promise(async (resolve, reject) => {
    try {
      const privatePem = await readFile('./private.pem');
      const privateKey = await jose.importPKCS8(
        privatePem.toString(),
        'RSA-OAEP'
      );
   
      const { payload: decoded } = await jose.jwtDecrypt(token, privateKey);
      resolve(decoded);
    } catch (error) {
      console.log('error', error.message);
      reject(error);
    }
  });
}

[panva]

Kindly provide a complete reproduction gist that can be run out of the box.

[NeleOb]

@saoodahmad Did you get it to run? I have the same problem.

[NeleOb]

here is my example code:

// keys
const pkcs8_rsa = `-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC4ZtdaIrd1BPIJ
tfnF0TjIK5inQAXZ3XlCrUlJdP+XHwIRxdv1FsN12XyMYO/6ymLmo9ryoQeIrsXB
XYqlET3zfAY+diwCb0HEsVvhisthwMU4gZQu6TYW2s9LnXZB5rVtcBK69hcSlA2k
ZudMZWxZcj0L7KMfO2rIvaHw/qaVOE9j0T257Z8Kp2CLF9MUgX0ObhIsdumFRLaL
DvDUmBPr2zuh/34j2XmWwn1yjN/WvGtdfhXW79Ki1S40HcWnygHgLV8sESFKUxxQ
mKvPUTwDOIwLFL5WtE8Mz7N++kgmDcmWMCHc8kcOIu73Ta/3D4imW7VbKgHZo9+K
3ESFE3RjAgMBAAECggEBAJTEIyjMqUT24G2FKiS1TiHvShBkTlQdoR5xvpZMlYbN
tVWxUmrAGqCQ/TIjYnfpnzCDMLhdwT48Ab6mQJw69MfiXwc1PvwX1e9hRscGul36
ryGPKIVQEBsQG/zc4/L2tZe8ut+qeaK7XuYrPp8bk/X1e9qK5m7j+JpKosNSLgJj
NIbYsBkG2Mlq671irKYj2hVZeaBQmWmZxK4fw0Istz2WfN5nUKUeJhTwpR+JLUg4
ELYYoB7EO0Cej9UBG30hbgu4RyXA+VbptJ+H042K5QJROUbtnLWuuWosZ5ATldwO
u03dIXL0SH0ao5NcWBzxU4F2sBXZRGP2x/jiSLHcqoECgYEA4qD7mXQpu1b8XO8U
6abpKloJCatSAHzjgdR2eRDRx5PMvloipfwqA77pnbjTUFajqWQgOXsDTCjcdQui
wf5XAaWu+TeAVTytLQbSiTsBhrnoqVrr3RoyDQmdnwHT8aCMouOgcC5thP9vQ8Us
rVdjvRRbnJpg3BeSNimH+u9AHgsCgYEA0EzcbOltCWPHRAY7B3Ge/AKBjBQr86Kv
TdpTlxePBDVIlH+BM6oct2gaSZZoHbqPjbq5v7yf0fKVcXE4bSVgqfDJ/sZQu9Lp
PTeV7wkk0OsAMKk7QukEpPno5q6tOTNnFecpUhVLLlqbfqkB2baYYwLJR3IRzboJ
FQbLY93E8gkCgYB+zlC5VlQbbNqcLXJoImqItgQkkuW5PCgYdwcrSov2ve5r/Acz
FNt1aRdSlx4176R3nXyibQA1Vw+ztiUFowiP9WLoM3PtPZwwe4bGHmwGNHPIfwVG
m+exf9XgKKespYbLhc45tuC08DATnXoYK7O1EnUINSFJRS8cezSI5eHcbQKBgQDC
PgqHXZ2aVftqCc1eAaxaIRQhRmY+CgUjumaczRFGwVFveP9I6Gdi+Kca3DE3F9Pq
PKgejo0SwP5vDT+rOGHN14bmGJUMsX9i4MTmZUZ5s8s3lXh3ysfT+GAhTd6nKrIE
kM3Nh6HWFhROptfc6BNusRh1kX/cspDplK5x8EpJ0QKBgQDWFg6S2je0KtbV5PYe
RultUEe2C0jYMDQx+JYxbPmtcopvZQrFEur3WKVuLy5UAy7EBvwMnZwIG7OOohJb
vkSpADK6VPn9lbqq7O8cTedEHttm6otmLt8ZyEl3hZMaL3hbuRj6ysjmoFKx6CrX
rK0/Ikt5ybqUzKCMJZg2VKGTxg==
-----END PRIVATE KEY-----`

const spki_rsa = `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuGbXWiK3dQTyCbX5xdE4
yCuYp0AF2d15Qq1JSXT/lx8CEcXb9RbDddl8jGDv+spi5qPa8qEHiK7FwV2KpRE9
83wGPnYsAm9BxLFb4YrLYcDFOIGULuk2FtrPS512Qea1bXASuvYXEpQNpGbnTGVs
WXI9C+yjHztqyL2h8P6mlThPY9E9ue2fCqdgixfTFIF9Dm4SLHbphUS2iw7w1JgT
69s7of9+I9l5lsJ9cozf1rxrXX4V1u/SotUuNB3Fp8oB4C1fLBEhSlMcUJirz1E8
AziMCxS+VrRPDM+zfvpIJg3JljAh3PJHDiLu902v9w+Iplu1WyoB2aPfitxEhRN0
YwIDAQAB
-----END PUBLIC KEY-----`

// use library
const jose = require('jose')

async function encrypt_decrypt() {
    // set keys
    const ecPrivateKey_rs256 = await jose.importPKCS8(pkcs8_rsa, "RSA-OAEP")
    prvKey = ecPrivateKey_rs256;
    const ecPublicKey_rs256 = await jose.importSPKI(spki_rsa, "RSA-OAEP")
    pubKey = ecPublicKey_rs256;

    // encrypt
    const jwe = await new jose.CompactEncrypt(new TextEncoder().encode("test"))
        .setProtectedHeader({ alg: "RSA-OAEP", "enc": "A128GCM" })
        .encrypt(pubKey)
    console.log(jwe)
    try {
        // decrypt
        const { payload, protectedHeader } = await jose.jwtDecrypt(jwe, prvKey)
        console.log(protectedHeader)
        console.log(payload)
    } catch (err) {
        console.log(err)
    }
}

encrypt_decrypt()

Here is my concole output:

eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.df_ZcgYWox6ypIaygQMh8d0XvaPB-h-NFThv39wSOmsyXBgF4ihSZ14JK6Dycu0767xhdUed6mhpane060fHGoJCC25E1EqnQ4wT3cFskKQZ92150pvfV0OSVQbt9QTxp-OczwbMglXQ52W662-DS7eOXir-9M108koegWcT_h2EGN5PeSYk6ccSh1yfwdyhBmuKq44PJF3PCpdCMYllvmyNgIdEVk-41IBzk7J2J1aiCKhhOSsBz0Gh6fXjN_-bC_YhUy7QUPQbMKrFkcGqVH1GkJcDXZBZObRXchHFjp14WYWDksissa2l4C0NOXIZlWotzA2PghZYd4ziCPkh4w.37K9yZgKpqc6aO_I.HRF1iA.7ItNhwUQ_HGsLi5dDUPbUA
JWTInvalid: JWT Claims Set must be a top-level JSON object
    at exports.default (/home/dev/Documents/Code/JavaScript/node_modules/jose/dist/node/cjs/lib/jwt_claims_set.js:32:15)
    at Object.jwtDecrypt (/home/dev/Documents/Code/JavaScript/node_modules/jose/dist/node/cjs/jwt/decrypt.js:9:53)
    at async encrypt_decrypt (/home/dev/Documents/Code/JavaScript/example.js:57:46) {
  code: 'ERR_JWT_INVALID'
}

[panva]

That's a distinctly different error code than what the OP is posting above.

You just need to stop using a JWT decrypt method since you're not encrypting a JWT but rather an arbitrary plaintext. use compactDecrypt instead of jwtDecrypt.

[NeleOb]

I am using compactDecrypt now. But my payload is empty. But it should be "test".

new code:

try {
        const { payload, protectedHeader } = await jose.compactDecrypt(jwe, prvKey)
        console.log(protectedHeader)
        console.log(new TextDecoder().decode(payload))
    } catch (err) {
        console.log(err)
    }

my output:

eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhHQ00ifQ.K3dt5zmfeX6Li1UX0HnIH1AGczbfOs1beJjzIUWttadew-7QBBkB9l1urARVXDJ5paPPKxBy728PhCbfsKPMlidPSi5nmo5mvpdC21uzoFJM-zLAQLsxxvzlHwUgq7pRrNqSFDiFlNUbFuyRuxA0FC1qiHjW7mAMAZsJ-mZofSr354qJ9YnnR-RkpccgJdwStlXVwLbI3MeGoQau2fbKdWkzJnVc0P8s1k9JROIxzwLC2XNt_QWMHE9XpL_mLNH9itycaznKzce_4li6U6WC2DR1zhKtY7w6HivXGzT93QayXwZ-yYY3WK3i23o3sROWidiVkynecYWwfWpPWanPlw.1ADA2HTY1VG3p4tM.LE86vg.TY3zlFcLIIGaftuBvCvCZg
{ alg: 'RSA-OAEP', enc: 'A128GCM' }

[panva]

There's no payload return from compactDecrypt, please refer to the documentation.

[NeleOb]

Changed payload to plaintext. No it works. Thank you.