jwk = JWT::JWK.import(keyHash) *** ArgumentError Exception: invalid base64

Question

I'm trying to do te backend apple login and it looks work good until the line jwk = JWT::JWK.import(keyHash) it's always return the error invalid base64. I'm using the gem jwt version 2.2.1 and Ruby 2.2.4

begin
  header_segment = JSON.parse(Base64.decode64(jwt.split(".").first))
  alg = header_segment["alg"]
  kid = header_segment["kid"]

  apple_response = Net::HTTP.get(URI.parse(GET_PK_APPLE_URL))
  apple_certificate = JSON.parse(apple_response)

  keyHash = ActiveSupport::HashWithIndifferentAccess.new(apple_certificate["keys"].select {|key| key["kid"] == kid}[0])

  jwk = JWT::JWK.import(keyHash)

  token_data = JWT.decode(jwt, jwk.public_key, true, {algorithm: alg})[0]

  if token_data.has_key?("sub") && token_data.has_key?("email") && userIdentity == token_data["sub"]
    puts "Name: " + name + " is validated."
    login_or_create_user('apple')
  else
    render_error
  end
rescue StandardError => e
  render_error
end

Answer 1

I found the problem, the jwt gem has a openssl dependency and the openssl needs a more actual version from Ruby, I couldn't change my Ruby version now for other reasons so I needed to change my code to get the JWK without use ```JWT::JWK.import(keyHash)```` . I also needed to user the UrlSafeBase64 gem.

begin      
  header_segment = JSON.parse(Base64.decode64(jwt.split(".").first))
  alg = header_segment["alg"]
  kid = header_segment["kid"]

  apple_response = Net::HTTP.get(URI.parse(LOGIN_APPLE_URL))
  apple_certificate = JSON.parse(apple_response)

  keyHash = ActiveSupport::HashWithIndifferentAccess.new(apple_certificate["keys"].select {|key| key["kid"] == kid}[0])      
  key = OpenSSL::PKey::RSA.new
  key.e = OpenSSL::BN.new(UrlSafeBase64.decode64(keyHash["e"]), 2)
  key.n = OpenSSL::BN.new(UrlSafeBase64.decode64(keyHash["n"]), 2)
                  
  token_data = JWT.decode(jwt, key, true, {algorithm: alg})[0]
  
  if token_data.has_key?("sub") && token_data.has_key?("email") && userIdentity == token_data["sub"]        
    login_or_create_user('apple')
  else
    render_error
  end
rescue StandardError => e
  render_error
end