token is unverifiable: signing method (alg) is unavailable

[eeshankeni]

Hi, I'm getting this error when trying to log in. Can confirm my handle and appkey are correct. If they are not, I do indeed get the second error. Right now it directly takes me to the third case and prints the error "token is unverifiable: signing method (alg) is unavailable"

blueSkyClient, err := bluesky.Dial(ctx, bluesky.ServerBskySocial)
if err != nil {
	panic(err)
}

defer blueSkyClient.Close()

err = blueSkyClient.Login(ctx, blueskyHandle, blueskyAppkey)

switch {
case errors.Is(err, bluesky.ErrMasterCredentials):
	panic("You're not allowed to use your full-access credentials, please create an appkey")
case errors.Is(err, bluesky.ErrLoginUnauthorized):
	panic("Username of application password seems incorrect, please double check")
case err != nil:
	fmt.Println(err)
	panic("Something else went wrong, please look at the returned error")
}

[eeshankeni]

Not exactly a "fix" but removing the error checking during decoding within the Login method fixed the issue for now.

// Verify and reject master credentials, sorry, no bad security practices
token, _, _ := jwt.NewParser().ParseUnverified(sess.AccessJwt, jwt.MapClaims{})

if token.Claims.(jwt.MapClaims)["scope"] != "com.atproto.appPass" {
	return fmt.Errorf("%w: %w", ErrLoginUnauthorized, ErrMasterCredentials)
}
// Retrieve the expirations for the current and refresh JWT tokens
current, err := token.Claims.GetExpirationTime()
if err != nil {
	return err
}

token, _, _ = jwt.NewParser().ParseUnverified(sess.AccessJwt, jwt.MapClaims{})

refresh, err := token.Claims.GetExpirationTime()
if err != nil {
	return err
}
// Construct the authenticated client and the JWT expiration metadata
c.client.Auth = &xrpc.AuthInfo{
	AccessJwt:  sess.AccessJwt,
	RefreshJwt: sess.RefreshJwt,
	Handle:     sess.Handle,
	Did:        sess.Did,
}
c.jwtCurrentExpire = current.Time
c.jwtRefreshExpire = refresh.Time

[emidoots]

I know +1 comments are not useful, but figured since this is a smaller project I'd mention I also ran into it.

[racerxdl]

So a better fix is:

1. Install github.com/ureeves/jwt-go-secp256k1
2. Create a wrapper (since it has incompatible signatures):

type es256k struct{}

func (e *es256k) Verify(signingString string, sig []byte, key interface{}) error {
	return secp256k1.SigningMethodES256K.Verify(signingString, string(sig), key)
}

func (e *es256k) Sign(signingString string, key interface{}) ([]byte, error) {
	sig, err := secp256k1.SigningMethodES256K.Sign(signingString, key)
	if err != nil {
		return nil, err
	}
	return []byte(sig), nil
}

func (e *es256k) Alg() string {
	return "ES256K"
}

func init() {
	// Register ES256K signing method
	jwt.RegisterSigningMethod("ES256K", func() jwt.SigningMethod {
		return &es256k{}
	})
}

3. Profit!

[dewey]

I've tried to run this commit from Erisa and unfortunately I'm running into the following error. Was anyone else able to get it to work yet?

github.com/ethereum/go-ethereum/crypto/secp256k1
# github.com/ethereum/go-ethereum/crypto/secp256k1
vendor/github.com/ethereum/go-ethereum/crypto/secp256k1/curve.go:42:10: fatal error: 'libsecp256k1/include/secp256k1.h' file not found
   42 | #include "libsecp256k1/include/secp256k1.h"
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.

[jasondborneman]

I'm also running into this issue. A shame this project seems to be dormant for a year, it's got a nice simple interface.

[Erisa]

We (Tailscale) have a fork which has this problem resolved: https://github.com/tailscale/go-bluesky

Based on my understanding of how the code was functioning, we made the choice to ignore these errors as despite them being verification errors the verification is not actually happening in the code path (https://github.com/dgrijalva/jwt-go/blob/master/parser.go#L141) - the error that the signing method is unavailable is only relevant if you intend to later verify the signature, which this code does not since the JWT is being generated by and sent to Bluesky and they will reject it if it is invalid. Justification and approval took place in tailscale#1 and I added some other missed verification errors in tailscale@59cb595