JOSE_ALG_NOT_ALLOWED error on API verify

[zarnautovic]

Hi,

We are using our API to verify auth and then create users in our database on registration finished.
We follow your guidelines from documentation: link.

Occasionally an error occurs:
"error": {
"code": "ERR_JOSE_ALG_NOT_ALLOWED",
"name": "JOSEAlgNotAllowed"
}

Id token and app pub key are supplied every time and we can see that in our logs.

Do you have idea what can be problem that causing this random error ?

[shahbaz17]

Hi @zarnautovic

I am assuming the idToken you're getting is from web3auth. In that case, the code described here would allow you to verify the token in your backend.

Please check out https://github.com/Web3Auth/examples/blob/main/web-core-sdk/server-side-verification/ssv-via-social-nextjs-core-example/pages/api/login.ts from our example repo to see how we have used it in a next.js application.

The version used in the example is "jose": "^4.11.1",. May I know which version are you using?

[zarnautovic]

Hi @shahbaz17

Yeah idToken is from web3Auth

I am have identical code on my backend:
const jwks = jose.createRemoteJWKSet( new URL('https://api.openlogin.com/jwks'), );

const jwtDecoded = await jose.jwtVerify(idToken, jwks, { algorithms: ['ES256'], });

and my jose version is: "^4.11.1",

This is strange because error is random, every n request I got this error previous n-1 request went fine.