Function Compute:Configure JWT authentication for an HTTP trigger

Before you start

Create a function and an HTTP trigger for the function. For more information, see Create a function and Step 1: Create a trigger.

Limits

• You can generate and distribute JWTs based on your business requirements. Function Compute authenticates the JWTs by using the public JWKS configured for the trigger.

• A JSON Web Key (JWK) that does not have kid (key ID) is supported.

• A token can be read from a header, the query parameter (by using the GET method), the form parameter (by using the POST method), or a cookie.

• You can forward claims as headers, query parameters (by using the GET method), forms parameters (by using the POST method), and cookies to functions.

• You can configure a JWKS for an HTTP trigger. After the JWKS is configured, the system searches the JWKS for a public JWK that has the same kid as the kid in the token and uses the public JWK to verify the signature of the token. The JWKS of a trigger is allowed to have at most one JWK whose kid does not exist or is set to an empty string.

  The following table lists the algorithms that are supported by the JWT of Function Compute.

  Signature algorithm	alg value
  RSASSA-PKCS1-V1_5	RS256, RS384, or RS512
  RSASSA-PSS	PS256, PS384, or PS512
  Elliptic Curve (ECDSA)	ES256, ES384, or ES512
  HMAC	HS256, HS384, or HS512
  EdDSA	EdDSA

  Important

  • The hash-based message authentication code (HMAC) signature algorithm uses symmetric encryption, which provides weak security. We recommend that you use an asymmetric encryption algorithm for enhanced security.

  • If you use an asymmetric encryption algorithm, you need to include information only about public keys, instead of private keys in your JWT, for security purposes.

  • We recommend that you use HTTPS to protect sensitive information such as tokens in requests to prevent token leakage.

Procedure

Step 1: Configure JWT authentication

Step 2: Verify JWT configurations

This section describes how to verify whether HTTP services can be accessed as expected by using a tool based on the JWT configurations of your HTTP trigger. In this section, Postman is used.

1. Use the private key in the X.509 PEM format generated in Step 1 as the private key to issue a JWT. The following steps use Python as an example to demonstrate the process of generating a token by using a local script.

   1. Install the PyJWT module.

      pip install PyJWT

   2. Run the following Python script on your on-premises machine to generate a JWT:

      import jwt
      import time
      
      private_key = """
      -----BEGIN PRIVATE KEY-----
      <Use the private key in the X.509 PEM format generated in Step 1>
      -----END PRIVATE KEY-----
      """
      
      headers = {
          "alg": "RS256",
          "typ": "JWT"
      }
      
      payload = {
          "sub": "1234567890",
          "name": "John Snow",
          "iat": int(time.time()),   # The time when the token was issued.
          "exp": int(time.time()) + 60 * 60,   # Set the validity period of the token to 1 hour.
      }
      
      
      encoded = jwt.encode(payload=payload, key=private_key.encode(), headers=headers)
      print("Generated token: %s" % encoded)
      

2. Use Postman to verify whether the HTTP service can be accessed as expected.

   1. Obtain the Internet URL from the Configurations > Triggers page and enter the URL in Postman.

   2. Configure the token parameters on the Headers tab in Postman. Then, click Send. The following table describes the configuration of the token.

      Name	Value	Description
      Key	Authentication	The name of the token that you specified in the JWT Token Configuration section.
      Value	Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9uIFNub3ciLCJhZG1pbiI6dHJ1ZSwiZXhwIjo0ODI5NTk3NjQxfQ.eRcobbpjAd3OSMxcWbmbicOTLjO2vuLR9F2QZMK4rz1JqfSRHgwQVqNxcfOIO9ckDMNlF_3jtdfCfvXfka-phJZpHmnaQJxmnOA8zA3R4wF4GUQdz5zkt74cK9jLAXpokwrviz2ROehwxTCwa0naRd_N9eFhvTRnP3u7L0xn3ll4iOf8Q4jS0mVLpjyTa5WiBkN5xi9hkFxd__p98Pah_Yf0hVQ2ldGSyTtAMmdM1Bvzad-kdZ_wW0jcctIla9bLnOo-Enr14EsGvziMh_QTZ3HQtJuToSKZ11xkNgaz7an5de6PuF5ISXQzxigpFVIkG765aEDVtEnFkMO0xyPGLg	The JWT value, which contains the value of the Remove Prefix parameter in JWT Token Configuration. In this example, the Remove Prefix parameter is set to Bearer .

      Important

      The prefix and space of the JWT parameter in the request header must be the same as those of the Remove Prefix parameter in the JWT Token Configuration section. Otherwise, an error occurs when the trigger parses the token and reports the "invalid or expired jwt" error.

FAQ