<![CDATA[Issuing Signature failed tokens]]>Hi FusionAuth team, FA API has a weird behaviour when issuing JWT tokens.

Error example:

Firebase\JWT\SignatureInvalidException: Signature verification failed in /vendor/firebase/php-jwt/src/JWT.php:141

The setup is working well, but from time to time FA can generate an invalid access token. It happened 5 times over the weekend - rarely, but it does.
I use elliptic certificates, customers and guest JWT tokens and both were affected.
For the customers - I use lambda to fill custom claims, but for the guest - I use vend endpoint - so it's not related to the way to issue it.
Could you help me with it?
The invalid guest token:

eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Il9YZkZkRUlwN24yTEdkcVJjUGdtQVcxM1NMWSJ9.eyJleHAiOjE2ODgzNjg3ODEsImlhdCI6MTY1NjgxMTg0MSwianRpIjoiNGE1ODNjZDMtZDllZS00ZjExLWE3M2YtYTJkOTk5YzNmNzBkIiwiYXBwbGljYXRpb25JZCI6ImMyNDMyMWZhLTc5OTctNDRjMy04ZGVkLTI1MGEyMjNkNDQ5YSIsImN1c3RvbWVySWQiOjAsImN1c3RvbWVyR3JvdXBJZCI6MCwic3RvcmVUeXBlIjoxLCJmYVVzZXJJZCI6MCwic3RvcmVJZCI6MSwid2Vic2l0ZUlkIjoxLCJsb2NhbGUiOiJlbl9HQiJ9.AGwaLswrLuwvOHpwcf4ayrLp8OLBB2XLXSl05oKNpABGH7j4dRbOaRhmZD5vZm4eZxICWsaWCzSowNLzsLxL6g
]]>https://fusionauth.io/community/forum/topic/2115/issuing-signature-failed-tokensRSS for NodeTue, 21 Jul 2026 13:15:08 GMTMon, 04 Jul 2022 16:18:34 GMT60<![CDATA[Reply to Issuing Signature failed tokens on Tue, 19 Jul 2022 14:36:07 GMT]]>Created the github issue - https://github.com/FusionAuth/fusionauth-issues/issues/1795

]]>https://fusionauth.io/community/forum/post/5321https://fusionauth.io/community/forum/post/5321Tue, 19 Jul 2022 14:36:07 GMT<![CDATA[Reply to Issuing Signature failed tokens on Thu, 07 Jul 2022 15:12:30 GMT]]>@aleksandr-vits-rimer

Ah, if you can replicate it across environments and languages, it may be some kind of bug. (Latest version is 1.36.8 but I don't see any issues in the release notes that would have affected this.)

It would be great if you could write up reproduction steps and file an issue here so we can take a look:

https://github.com/FusionAuth/fusionauth-issues/issues/new?assignees=&labels=&template=bug_report.md

Feel free to reference this forum post in the "additional context" section. And if you can provide a sample script, that would be helpful.

I noticed it happening spikely and probably related to the same spikes on the ES cluster. Is it possible that issuing the new jwt depends on ES health?

I don't think so, but if your machine is starved of resources due to a spike, it may be the request for the public keys endpoint is not returning in the appropriate expected timeframe, causing the validation to fail. Usually libraries cache this JWKS value, or you can use a HTTP proxy in front of FusionAuth to cache the JWKS values for ~5 minutes.

(Also, I voted up your post, so future posts from you won't be moderated.)

]]>https://fusionauth.io/community/forum/post/5297https://fusionauth.io/community/forum/post/5297Thu, 07 Jul 2022 15:12:30 GMT<![CDATA[Reply to Issuing Signature failed tokens on Thu, 07 Jul 2022 12:26:02 GMT]]>@dan the version - v1.36.7

]]>https://fusionauth.io/community/forum/post/5296https://fusionauth.io/community/forum/post/5296Thu, 07 Jul 2022 12:26:02 GMT<![CDATA[Reply to Issuing Signature failed tokens on Thu, 07 Jul 2022 15:07:11 GMT]]>Thank you for your answer. The jwt token validation is unrelated to the library because I have the same behaviour on the python validator on the different microservice. (I checked signature failed on 3 different environments, including manual checking on my local machine)
I noticed it happening spikely and probably related to the same spikes on the ES cluster. Is it possible that issuing the new jwt depends on ES health?
I see GC problems at the same time on my ES cluster and that is why I'm asking.
This is a public key (better to remove it before publishing if it is possible)

(removed)
]]>https://fusionauth.io/community/forum/post/5295https://fusionauth.io/community/forum/post/5295Thu, 07 Jul 2022 15:07:11 GMT<![CDATA[Reply to Issuing Signature failed tokens on Thu, 07 Jul 2022 10:54:12 GMT]]>@aleksandr-vits-rimer

Hiya,

This is not an issue I've seen before. Would need a bit more info to help you troubleshoot.

What version of FusionAuth are you running?

Are there common claims, keys, or other similarities for the tokens that are failing to be verified?

Verification depends on the library you are using with php-jwt. Which library are you using? It looks like you should be using openSSL, based on the header for the token you provided (which is using ES256 for the alg) and this line: https://github.com/firebase/php-jwt/blob/main/src/JWT.php#L57 What version of openssl do you have installed?

Also, I'd make sure that the key (via JWKS) is always available to the client. I don't know that that is the issue, but if the public key is not available, that will cause problems.

]]>https://fusionauth.io/community/forum/post/5294https://fusionauth.io/community/forum/post/5294Thu, 07 Jul 2022 10:54:12 GMT<![CDATA[Reply to Issuing Signature failed tokens on Thu, 07 Jul 2022 07:52:42 GMT]]>Hi, any updates here?
My token is valid for a year, but the signature failed for it. And it was issued by vend endpoint from FA. And it was signed by a key that was generated via "generate elliptic" button in the FA admin.

]]>https://fusionauth.io/community/forum/post/5293https://fusionauth.io/community/forum/post/5293Thu, 07 Jul 2022 07:52:42 GMT