jose: skip malformed keys in Jwt.verify multi-key import

Follow-up to the security hardening: Jwt.verify imported every compatible
candidate key and failed the whole verification if any single one rejected,
so one malformed key in an otherwise-valid JWK Set could deny service to
tokens signed by the good keys. Import each candidate independently and skip
the unusable ones, mirroring Jws.verify; still fail closed when none import.

Author: leonitousconforti

packages/effect/src/unstable/jose/Jwt.ts

@@ -215,11 +215,19 @@ export const verify = Effect.fnUntraced(function*(
     .filter((jwk) => hint.kid === undefined || jwk.kid === undefined || jwk.kid === hint.kid)
   if (candidates.length === 0) return yield* new JwtError({ reason: "UnknownKey" })
 
-  const publicKeys = yield* Effect.forEach(candidates, (jwk) =>
-    Effect.tryPromise({
-      try: () => crypto.subtle.importKey("jwk", jwk as JsonWebKey, Jwa.importParameters(hint.alg), false, ["verify"]),
-      catch: () => new JwtError({ reason: "UnknownKey" })
-    }))
+  // Import each candidate independently, skipping any key whose material is
+  // malformed rather than failing the whole verification — one bad key in an
+  // otherwise-valid JWK Set must not deny service to tokens signed by the
+  // good keys.
+  const imported = yield* Effect.forEach(
+    candidates,
+    (jwk) =>
+      Effect.tryPromise(() =>
+        crypto.subtle.importKey("jwk", jwk as JsonWebKey, Jwa.importParameters(hint.alg), false, ["verify"])
+      ).pipe(Effect.catch(() => Effect.succeed(null as CryptoKey | null)))
+  )
+  const publicKeys = imported.filter((key): key is CryptoKey => key !== null)
+  if (publicKeys.length === 0) return yield* new JwtError({ reason: "UnknownKey" })
 
   const result = yield* Jws.verify({ publicKeys, payload: ClaimsFromJson })(flattened).pipe(
     Effect.mapError((error) =>

packages/effect/test/unstable/jose/Security.test.ts

@@ -43,6 +43,19 @@ describe("JOSE security remediations", () => {
         assert.strictEqual(verified.sub, "sub")
       }).pipe(Effect.runPromise))
 
+    it("verifies against a JWK Set containing a malformed key alongside the good one", () =>
+      Effect.gen(function*() {
+        const { privateJwk, publicJwk } = yield* Jwt.generateSigningKey()
+        const token = yield* Jwt.sign({ privateJwk, payload: claims })
+        // a compatible (ES256) but structurally broken key must be skipped, not fatal
+        const brokenKey = { ...publicJwk, x: "!!!not-base64!!!", kid: undefined }
+        const verified = yield* Jwt.verify(token, {
+          jwks: { keys: [brokenKey as typeof publicJwk, publicJwk] },
+          algorithms: ["ES256"]
+        })
+        assert.strictEqual(verified.sub, "sub")
+      }).pipe(Effect.runPromise))
+
     it("enforces the typ header when types is supplied", () =>
       Effect.gen(function*() {
         const { privateJwk, publicJwk } = yield* Jwt.generateSigningKey()