如何解码SafetyNet JWS响应？

Question

SafetyNet.getClient(this).attest(NONCE, <API KEY>)
        .addOnSuccessListener(this, new OnSuccessListener<SafetyNetApi.AttestationResponse>() {
            @Override
            public void onSuccess(final SafetyNetApi.AttestationResponse attestationResponse) {
                initialDataExtraction(attestationResponse.getJwsResult());
            }
        })
        .addOnFailureListener(this, new OnFailureListener() {
            @Override
            public void onFailure(@NonNull final Exception exception) {
                if (exception instanceof ApiException) {
                    final ApiException apiException = (ApiException) exception;
                    Log.e(TAG, "onFailure: " + apiException.getMessage() + " " + apiException.getStatusCode());
                } else {
                    Log.e(TAG, "Error: ", exception);
                }
            }
        });

private byte[] initialDataExtraction(final String jwsResult) {

    final String[] jwsResultParts = jwsResult.split("[.]");
    if (jwsResultParts.length == 3) {
        final byte[] header = Base64.decode(jwsResultParts[0], Base64.NO_WRAP);
        final byte[] data = Base64.decode(jwsResultParts[1], Base64.NO_WRAP);
        final byte[] signature = Base64.decode(jwsResultParts[2], Base64.NO_WRAP);

        Log.d(TAG, "initialDataExtraction: header = " + new String(header, UTF_8));
        Log.d(TAG, "initialDataExtraction: data = " + new String(data, UTF_8));
        Log.d(TAG, "initialDataExtraction: signature = " + new String(signature, UTF_8));

        return data;
    } else {
        Log.e(TAG, "initialDataExtraction: Failure: Illegal JWS signature format. The JWS consists of " + jwsResultParts.length + " parts instead of 3.");
        return null;
    }
}

java.lang.IllegalArgumentException: bad base-64
 at android.util.Base64.decode(Base64.java:161)
 at android.util.Base64.decode(Base64.java:136)
 at android.util.Base64.decode(Base64.java:118)

在解码签名部分时。

当解码看到这个断断续续的错误时，我做错了什么？

然后，我开始使用JWT库来解码令牌。

首先我尝试了组：“com.auth0.android”，名称：“jwtdecode”，版本：“1.1.1”

 final JWT jwt = new JWT(jwsResult);

com.auth0.android.jwt.DecodeException: The token's payload had an invalid JSON format.
at com.auth0.android.jwt.JWT.parseJson(JWT.java:235)
at com.auth0.android.jwt.JWT.decode(JWT.java:203)
at com.auth0.android.jwt.JWT.<init>(JWT.java:40)
Caused by: com.google.gson.JsonSyntaxException: java.lang.IllegalStateException: Expected a string but was BEGIN_ARRAY at line 1 column 23 path $.
at com.google.gson.Gson.fromJson(Gson.java:899)
at com.google.gson.Gson.fromJson(Gson.java:852)
at com.google.gson.Gson.fromJson(Gson.java:801)

The "x5c" (X.509 Certificate Chain) Header Parameter contains the
   X.509 public key certificate or certificate chain [RFC5280]
   corresponding to the key used to digitally sign the JWS.  The
   certificate or certificate chain is represented as a JSON array of
   certificate value strings. 

String token = "<JWS TOKEN>";
        try {
            final DecodedJWT jwt = JWT.decode(token);
            System.out.println("Header = " + jwt.getHeader());
            System.out.println("Payload = " + jwt.getPayload());
            System.out.println("Signature = " + jwt.getSignature());
                } catch (JWTDecodeException exception){
           throw new RuntimeException(exception);
        }

我在我的Android应用程序中做错了什么，阻止了auth0 Android jwt库的正常工作？

然后我在我的Android应用程序中尝试了'io.jsonwebtoken:jjwt:0.9.0'库。

当我执行这个代码时：-

Jwts.parser().parse(jwsResult).getBody();

java.lang.IllegalArgumentException: A signing key must be specified if the specified JWT is digitally signed.
 at io.jsonwebtoken.lang.Assert.notNull(Assert.java:85)
 at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:331)

Jwts.parser().setSigningKey<API KEY>.parse(jwsResult).getBody();

java.lang.IllegalArgumentException: Key bytes can only be specified for HMAC signatures. Please specify a PublicKey or PrivateKey instance.
at io.jsonwebtoken.lang.Assert.isTrue(Assert.java:38)
at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:324)

我从这个问题base64:java.lang.IllegalArgumentException：非法字符中发现了java.lang.IllegalArgumentException：bad base-64问题的修复程序

解码前只需替换jws令牌中的字符

token.replace('-', '+').replace('_', '/')

Answer 1

我发现这个库不仅能完成工作，而且在Android上运行良好。

// https://mvnrepository.com/artifact/com.nimbusds/nimbus-jose-jwt
implementation group: 'com.nimbusds', name: 'nimbus-jose-jwt', version: '5.1'


    try {
        final JWSObject jwsObject = JWSObject.parse(jwsResult);
        System.out.println("header = " + jwsObject.getHeader());
        System.out.println("header = " + jwsObject.getHeader().getX509CertChain());
        System.out.println("payload = " + jwsObject.getPayload().toJSONObject());
        System.out.println("signature = " + jwsObject.getSignature());
        System.out.println("signature = " + jwsObject.getSignature().decodeToString());
    } catch (ParseException e) {
        e.printStackTrace();
    }

提供了一些很好的例子：-

https://connect2id.com/products/nimbus-jose-jwt/examples