Function Compute:Configure JWT Authentication for HTTP Triggers

1. Log on to the Function Compute console. In the left-side navigation pane, click Services & Functions.

2. In the top navigation bar, select a region. On the Services page, click the desired service.

3. On the Functions page, click the name of the desired function. On the Function Details page that appears, click the Trigger Management (URL) tab.

4. On the Trigger Management (URL) tab, click the Edit button in the Actions column for the HTTP trigger.

5. On the Edit Trigger panel, configure the following items, then click OK.

   1. Set Authentication Method to JWT Authentication.

      

   2. Configure JWKS.

      To configure JWT authentication for an HTTP trigger, provide a valid JSON Web Key Set (JWKS). Generate a JWKS yourself, or search for JSON Web Key Generator to find online tools, such as mkjwk.org. If you have a PEM-formatted key, use a tool, such as jwx, to convert it to JWKS format.

      This topic demonstrates generating a JWKS using mkjwk.org. As shown in the following figure, on the generation interface, set Key Use to Signature, Algorithm to RS256, and Show X.509 to Yes. Then, click Generate. Use the Private Key (① in the figure) in your code to issue JWT Tokens. Keep it secure. Copy the content of the Public Key (② in the figure) into the keys array of the JWKS configuration in the console.

      

      

      The following example shows the JWKS configured in this topic.

      {
          "keys": [
              {
                  "alg": "RS256",
                  "e": "AQAB",
                  "kty": "RSA",
                  "n": "u1LWgoomekdOMfB1lEe96OHehd4XRNCbZRm96RqwOYTTc28Sc_U5wKV2umDzolfoI682ct2BNnRRahYgZPhbOCzHYM6i8sRXjz9Ghx3QHw9zrYACtArwQxrTFiejbfzDPGdPrMQg7T8wjtLtkSyDmCzeXpbIdwmxuLyt_ahLfHelr94kEksMDa42V4Fi5bMW4cCLjlEKzBEHGmFdT8UbLPCvpgsM84JK63e5ifdeI9NdadbC8ZMiR--dFCujT7AgRRyMzxgdn2l-nZJ2ZaYzbLUtAW5_U2kfRVkDNa8d1g__2V5zjU6nfLJ1S2MoXMgRgDPeHpEehZVu2kNaSFvDUQ",
                  "use": "sig"
              }
          ]
      }

   3. In the JWT Token Configuration, select the Token location and Token name.

      Token location supports Header, Cookie, Query parameters (GET), and form parameters (POST). If you select Header as the Token location, specify the Parameter Name and Prefix to Remove. Function Compute removes the prefix content set in Prefix to Remove when retrieving the Token.

      Important

      When setting Prefix to Remove, check for a space after the prefix. Add a space after the prefix field, such as Bearer .

   4. In the JWT Claim Transformation configuration, select the parameter location, original parameter name, and the parameter name after passing it to the function.

      Mapped parameter locations support Header, Cookie, and form parameters (POST).

   5. Set the request matching mode.

      • Match All: All HTTP requests require JWT validation.

      • Whitelist Mode: HTTP requests with paths set in the Request Path Whitelist do not require JWT validation. Other requests require JWT validation.

      • Blacklist Mode: HTTP requests with paths set in the Request Path Blacklist require JWT validation. Other requests do not require JWT validation.

      Whitelist Mode and Blacklist Mode support the following two matching modes.

      • Exact match

        The request path must exactly match the configured path. For example, if you set the Request Path Blacklist to /a, requests from path /a require JWT validation. Requests from path /a/ do not require validation.

      • Fuzzy match

        Use a wildcard character (*) to set paths. The wildcard character (*) can appear only at the end of the path. For example, if you set the Request Path Blacklist to /login/*, requests with the path prefix /login/ (such as /login/a or /login/b/c/d) require JWT validation.

In a debugging tool, such as Postman, enter the access endpoint and Token based on the HTTP trigger's JWT configuration. Verify that you can access the HTTP service.

1. Use the X.509 PEM-formatted Private Key generated in Step 1 as the private key to issue JWT Tokens. The following steps demonstrate how to generate a Token using a local Python script.

   1. Install the PyJWT module.

      pip install 'PyJWT>=2.0'

   2. Run the following Python example script locally to generate a JWT Token.

      import jwt
      import time
      
      private_key = """
      -----BEGIN PRIVATE KEY-----
      <Use the X.509 PEM-formatted private key generated in Step 1>
      -----END PRIVATE KEY-----
      """
      
      headers = {
          "alg": "RS256",
          "typ": "JWT"
      }
      
      payload = {
          "sub": "1234567890",
          "name": "John Snow",
          "iat": int(time.time()),   # Token issuance time
          "exp": int(time.time()) + 60 * 60,   # Set token validity to 1 hour
      }
      
      
      encoded = jwt.encode(payload=payload, key=private_key.encode(), headers=headers)
      print("Generated token: %s" % encoded)
      

2. Use Postman to verify that the HTTP service is accessible.

   1. On the Trigger Management (URL) tab of the target function, retrieve the public network access endpoint of the HTTP trigger and enter it in the URL field in Postman.

   2. In Postman's Headers, configure the Token parameter information, then click Send to send the request. The following example shows the Token filled in this topic.

      Name	Example Value	Description
      Key	Authentication	The parameter name set in JWT Token Configuration.
      Value	Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9uIFNub3ciLCJhZG1pbiI6dHJ1ZSwiZXhwIjo0ODI5NTk3NjQxfQ.eRcobbpjAd3OSMxcWbmbicOTLjO2vuLR9F2QZMK4rz1JqfSRHgwQVqNxcfOIO9ckDMNlF_3jtdfCfvXfka-phJZpHmnaQJxmnOA8zA3R4wF4GUQdz5zkt74cK9jLAXpokwrviz2ROehwxTCwa0naRd_N9eFhvTRnP3u7L0xn3ll4iOf8Q4jS0mVLpjyTa5WiBkN5xi9hkFxd__p98Pah_Yf0hVQ2ldGSyTtAMmdM1Bvzad-kdZ_wW0jcctIla9bLnOo-Enr14EsGvziMh_QTZ3HQtJuToSKZ11xkNgaz7an5de6PuF5ISXQzxigpFVIkG765aEDVtEnFkMO0xyPGLQ	In JWT Token Configuration, you can configure the system to remove the prefix when constructing the JWT token. For example, assume the prefix to be removed is set to Bearer .

      Important

      Note that the prefix and space of the JWT parameter in the request header must match the Prefix to Remove content set in JWT Token Configuration. Otherwise, the trigger fails to parse the Token and returns an "invalid or expired jwt" error.