AWS ALB JWT Padding Issue with Signature Verification

[nazyilmaz-redgate]

Description

When receiving JWT tokens signed by AWS Application Load Balancer (ALB) in the x-amzn-oidc-data header, I'm encountering verification issue due to AWS sending padded tokens.

Technical Details

1. Root Cause: AWS ALB appears to pad the JWT tokens it sends with = in the x-amzn-oidc-data header. Some more detailed explanation of the issue here (not my blog, many thanks to whoever did it)

2. Reproduction Scenario:

   • The x-amzn-oidc-data header contains a JWT with padding characters
   • When attempting to read/parse the JWT with padding, the JWT library fails
   • When padding is removed to allow successful parsing, signature verification fails

3. Technical Dilemma:

   • With padding: Cannot successfully read/parse the JWT
   • Without padding: Can read the token but signature verification fails

What I've done so far

• The padding is consistently present in tokens from AWS ALB
• The standard JWT library behavior expects tokens without this padding
• The signature verification specifically fails when padding is removed

I've found two libraries that support this weird thing AWS does ([one here](https://github.com/lestrrat-go/jwx/pull/1328/files, and other here), unfortunately neither of them .NET. A bit old, but people seem to be using workarounds. Would you be able to implement support for this?

[dvsekhvalnov]

Hi @nazyilmaz-redgate ,

can you post and example of AWS ALB token? Will be easier to troubleshoot. If you can share key for verification would be great (but please don't share anything used in production).

[dvsekhvalnov]

These tokens follow the JWT format but are not ID tokens. The JWT format includes a header, payload, and signature that are base64 URL encoded, and includes padding characters at the end. 

That's weird design decision :)) I don't know either ALB shouldn't send it to app backends or app should't parse access tokens and treat it opaque.

But back to support question - it seems pretty straightforward to add support to the library. Just normal Base64 encoding. Will still appreciate if you can capture real ALB token.