| 395 | |
| 396 | #[test] |
| 397 | fn rs256_wrong_key_rejected() { |
| 398 | use rsa::pkcs1v15::SigningKey; |
| 399 | use rsa::signature::{SignatureEncoding, Signer}; |
| 400 | |
| 401 | let mut rng = rsa::rand_core::OsRng; |
| 402 | let key1 = rsa::RsaPrivateKey::new(&mut rng, TEST_RSA_BITS).unwrap(); |
| 403 | let key2 = rsa::RsaPrivateKey::new(&mut rng, TEST_RSA_BITS).unwrap(); |
| 404 | let pub2 = rsa::RsaPublicKey::from(&key2); |
| 405 | |
| 406 | let pub2_der = { |
| 407 | use rsa::pkcs8::EncodePublicKey; |
| 408 | pub2.to_public_key_der().unwrap().as_ref().to_vec() |
| 409 | }; |
| 410 | |
| 411 | let header = base64_url_encode(br#"{"alg":"RS256","typ":"JWT"}"#); |
| 412 | let payload = base64_url_encode(br#"{"sub":"x","exp":9999999999}"#); |
| 413 | let signing_input = format!("{header}.{payload}"); |
| 414 | |
| 415 | // Sign with key1. |
| 416 | let signing_key = SigningKey::<sha2::Sha256>::new(key1); |
| 417 | let sig: rsa::pkcs1v15::Signature = signing_key.sign(signing_input.as_bytes()); |
| 418 | let sig_b64 = base64_url_encode(&sig.to_bytes()); |
| 419 | let token = format!("{signing_input}.{sig_b64}"); |
| 420 | |
| 421 | // Verify with key2 — should fail. |
| 422 | let config = JwtConfig { |
| 423 | rsa_public_key_der: pub2_der, |
| 424 | ..Default::default() |
| 425 | }; |
| 426 | let validator = JwtValidator::new(config); |
| 427 | assert_eq!( |
| 428 | validator.validate(&token).err(), |
| 429 | Some(JwtError::InvalidSignature) |
| 430 | ); |
| 431 | } |
| 432 | |
| 433 | #[test] |
| 434 | fn unsupported_algorithm_rejected() { |