Function Compute:Configure JWT authentication for an HTTP trigger

Prerequisites

Create a function and an HTTP trigger. For more information, see Create a function and Create a trigger.

Limits

• You can use any method to generate and distribute JWTs. Function Compute authenticates JWTs using the public JWKS configured for the trigger.

• Function Compute supports a JSON Web Key (JWK) without a kid (key ID).

• The trigger can read a token from a request header, a Query parameter (for GET requests), a form parameter (for POST requests), or a cookie.

• You can forward claims to the function as a header, a form parameter (for POST requests), or a cookie.

• Function Compute allows you to configure a JWKS for an HTTP trigger. The system searches the JWKS for a public JWK with a kid that matches the one in the token. It then uses this public key to verify the token's signature. A JWKS for a trigger can have at most one JWK where the kid is missing or is an empty string.

  Function Compute JWT supports the following algorithms.

  Signature algorithm	Alg value
  RSASSA-PKCS1-V1_5	RS256, RS384, RS512
  RSASSA-PSS	PS256, PS384, PS512
  Elliptic Curve (ECDSA)	ES256, ES384, ES512
  HMAC	HS256, HS384, HS512
  EdDSA	EdDSA

  Important

  • The HMAC signature algorithm uses symmetric encryption and is less secure. We recommend that you use a more secure asymmetric encryption algorithm.

  • When you use an asymmetric encryption algorithm, for security, your JWT should contain only public key information. We recommend that you do not include private key information.

  • We recommend that you use HTTPS to protect sensitive information such as the token in requests to prevent token leakage.

Procedure

Step 1: Configure JWT authentication

Step 2: Verify the configuration

Use a testing tool, such as Postman, to verify that you can access the HTTP service as expected based on the JWT configuration of the HTTP trigger by providing an endpoint, token, and other information.

1. Use the X.509 PEM-format private key that you generated in Step 1 to issue a JWT token. The following steps show how to generate a token using a local Python script.

   1. Install the PyJWT module.

      pip install 'PyJWT>=2.0'

   2. Run the following sample Python script locally to generate a JWT token.

      import jwt
      import time
      
      private_key = """
      -----BEGIN PRIVATE KEY-----
      <The X.509 PEM-format private key generated in Step 1>
      -----END PRIVATE KEY-----
      """
      
      headers = {
          "alg": "RS256",
          "typ": "JWT"
      }
      
      payload = {
          "sub": "1234567890",
          "name": "John Snow",
          "iat": int(time.time()),   # The time when the token was issued.
          "exp": int(time.time()) + 60 * 60,   # Set the token to be valid for 1 hour.
      }
      
      
      encoded = jwt.encode(payload=payload, key=private_key.encode(), headers=headers)
      print("Generated token: %s" % encoded)
      

2. Use Postman to verify that the HTTP service is accessible.

   1. On the Trigger tab of the function details page, obtain the public endpoint of the HTTP trigger and enter it into the URL field in Postman.

   2. In Postman, configure the token parameter in the headers and click Send. The following table provides an example of the token configuration.

      Parameter	Value	Description
      Key	Authentication	The parameter name that you specified in the JWT Token Configuration section.
      Value	Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9uIFNub3ciLCJhZG1pbiI6dHJ1ZSwiZXhwIjo0ODI5NTk3NjQxfQ.eRcobbpjAd3OSMxcWbmbicOTLjO2vuLR9F2QZMK4rz1JqfSRHgwQVqNxcfOIO9ckDMNlF_3jtdfCfvXfka-phJZpHmnaQJxmnOA8zA3R4wF4GUQdz5zkt74cK9jLAXpokwrviz2ROehwxTCwa0naRd_N9eFhvTRnP3u7L0xn3ll4iOf8Q4jS0mVLpjyTa5WiBkN5xi9hkFxd__p98Pah_Yf0hVQ2ldGSyTtAMmdM1Bvzad-kdZ_wW0jcctIla9bLnOo-Enr14EsGvziMh_QTZ3HQtJuToSKZ11xkNgaz7an5de6PuF5ISXQzxigpFVIkG765aEDVtEnFkMO0xyPGLg	The value of the Remove Prefix parameter that you specified in the JWT Token Configuration section, concatenated with the JWT token. The example value assumes that Remove Prefix is set to Bearer .

      Important

      The prefix and space for the JWT parameter in the request header must exactly match the value of Remove Prefix that you specified in the JWT Token Configuration section. Otherwise, the trigger fails to parse the token and returns an invalid or expired jwt error.

FAQ