JWT 不使用 pkcs1v15.go 验证签名，但使用 jwt.io 验证答案

【问题标题】：JWT does not validate Signature with pkcs1v15.go but validates with jwt.ioJWT 不使用 pkcs1v15.go 验证签名，但使用 jwt.io 验证
【发布时间】：2021-03-22 09:39:02
【问题描述】：

这是我面临的问题，

https://play.golang.org/p/Pq8xHAERD57

如果您运行上面的代码，第一个令牌，JWKS 对不会验证签名，但第二个会！但两者都验证 jwt.io 中的签名。是否可以使用 Golang 库来验证它？

现在奇怪的是，如果你拿了失败的令牌？我调试发现它在函数 func VerifyPKCS1v15(pub *PublicKey, hash crypto.Hash, hashed []byte, sig []byte) 错误 {

上线

ok &= subtle.ConstantTimeCompare(em[k-hashLen:k], hashed)
ok &= subtle.ConstantTimeCompare(em[k-tLen:k-hashLen], prefix)

这与它的嵌套令牌有关吗？

这两个都返回 -1（不知道为什么要加密），但看起来签名不正确

失败的 JWT 令牌：

eyJraWQiOiIyMzZjODhkMS01YjUxLTRjZDMtYjczYi1kNmI0YzFmYmUxNzciLCJhbGciOiJSUzI1NiJ9.eyJqdGkiOiIzZTRkNDA5My04M2U2LTRiZGYtODkwYi1kNDBhYjgyMTE0MzkiLCJhdWQiOiJvYnJicy5vcGVuYmFua2luZy1jb25zZW50Lm9wZW5iYW5raW5nLWNvbnNlbnQtc3RhbmRhbG9uZSIsImlzcyI6InJic2cub3BlbmJhbmtpbmcuc2l0LnBheW1lbnRzLWxpbWl0cy12MSIsImV4cCI6MTYxMDYzMjQxNSwiaWF0IjoxNjEwNjMyMTE1LCJuYmYiOjE2MTA2MzIxMTUsIm1zX3Byb3BhZ2F0ZWRfand0IjoiZXlKcmFXUWlPaUpsT0dRMk1HSXlZaTB5T1RFeUxUUmpNamd0T0RNeE55MWhOemszT1dZeFlUVmtOamdpTENKaGJHY2lPaUpTVXpJMU5pSjkuZXlKcWRHa2lPaUpsTkRaa1l6VXdPQzAxWXpKaUxUUXhaall0WW1ZMU1TMWtZVE0yTVRKak9UWTVOak1pTENKaGRXUWlPaUp5WW5ObkxtOXdaVzVpWVc1cmFXNW5Mbk5wZEM1d1lYbHRaVzUwY3kxc2FXMXBkSE10ZGpFaUxDSnBjM01pT2lKdlluSmljeTV2Y0dWdVltRnVhMmx1WnkxaGRYUm9laTV2Y0dWdVltRnVhMmx1WnkxaGRYUm9laTF6ZEdGdVpHRnNiMjVsSWl3aVpYaHdJam94TmpFd05qTXlNVFF6TENKcFlYUWlPakUyTVRBMk16SXhNVE1zSW01aVppSTZNVFl4TURZek1qRXhNeXdpYlhOZmNISnZjR0ZuWVhSbFpGOXFkM1FpT2lKbGVVcHlZVmRSYVU5cFNUVmpRMGx6U1cxR2MxcDVTVFpKYTFaVVRXcFZNa2x1TUM1bGVVcDZaRmRKYVU5cFNYZE5WRUUwVGxSbmQwMUVVVFZKYVhkcFl6STViV1JJWkdoamJWWm1XVEo0Y0ZwWE5UQllNalZvWWxkVmFVOXBTa1ZTVmsxblVqSldkVnBZU25CWmVVSXdXbGhPTUVsSFRuTmhWMVoxWkVOQ1QxWXdTV2xNUTBwcFlWYzBhVTlwU1hoUFJFVXpUbXByZWs1VVkzZEphWGRwWVZoT2VrbHFiMmxWUjJ4MVdqQkdhbGt5Vm5wak1FWXhaRWRvVldJeWRHeGlhVWx6U1c1T2RscHVVak5aV0Vwc1dETlNkbU14T1RGamJXdHBUMmxLYjJSSVVuZGplbTkyVERKU2JHUnRWbk5pTTBKc1kyazFkVmxZVWpOYVdFNHdURzFPZG1KVE9XdGtWekYwWlZZNU1GcFlTblJqZVRWdlpFY3dhVXhEU21waFZ6UnBUMmxKZUUxRVZUVk9SR00xVGxSbk5FbHBkMmxrUjJoNVdsZEdNRmd6U214Wk1qbDVXa1k1ZVZwWVRqRmlTRkZwVDJsS1IxbFhiSE5rV0Vwc1NXbDNhV050Vm5wa1Z6RnNXRE5XZVdKRFNUWkpiV2d3WkVoQ2VrOXBPSFpoVjBaMFRGZEdNV1JIYUhWTVdFNXdaRU14ZVZsdVRYVmlWMFoxV1Zka2JGcElVbXhqTTFGMVdUSTVkRXd5Um5wTU0yUlpVMFprUTB3elNteGpNMVowV2xNNWFHTjVPV2hrV0ZKdllqTktjR1Z0UmpCaFZ6bDFURzVDY0dKdFkybE1RMHAzWVZoT2QxZ3pRbXhqYlRGd1l6Tk9jR0l5TldaYWJYaG9XbmxKTm1KdVZuTmlRM2RwV1RKNGNGcFhOVEJZTW14clNXcHZhVTV1YUZGV1ZXZzBZbFpPZEZScWFITmFhM2Q1VW0xS05tUllaM3BqZVVselNXNVNkR1ZHT1hwa1dFSjNZMjFXZW1NeWJIWmliRGx0WWtkR2JrbHFjSFZrVjNoelRFTktlbUl5V2pCa01rWjVXbFk1ZDJJeWVIQlpNMnhtWkZoS2NFbHFiMmxoU0ZJd1kwaE5Oa3g1T1d0YVdGcHNZa2M1ZDFwWVNYVmliVVl3WkRKV2VtUkROV3BpTWpCMldraFdkR0pZYkdaalJ6bHpZVmRPTlV4dGFEQmlVMGx6U1c1V2VscFlTbVpaV0ZZd1lVYzFabUpYVmpCaFJ6bHJTV3B2YVdGWFJuUk1XRWt3WTBNeE0xcFhTV2xNUTBwNllqSmFNR1F5Um5sYVZqbHdXa05KTmtscVdqUlZSbFpKWlVjeFZHSlZORFJpUjFwTlRXdGFhV1Z1VmpSTk0wMXBURU5LZG1OSFZuVlpiVVoxWVRKc2RWb3hPWEJpYmxKc1ltNVNabUZYVVdsUGFVcHFUa1JyZVU1RVVUTmFha1UwV1cxRk1FOUVSbWxaYWtFd1RrUkpORmx0VFhwUFYwVXhXVlJSTUUxcFNYTkpibEo2VFd3NWFGa3lUblprVnpVd1dESnNhMGxxYjJsVWFUbENTV2wzYVdSWVRteGpiRGt3WlZoQ2JFbHFiMmxVYVRsQ1NXbDNhVmt6Vm5wa1Jqa3daVmhDYkVscWIybFZSVlpUVlRBNVQxRlZkMmxNUTBwb1pGaFNiMkpzT1hSYVdGSnZZakpSYVU5cFNsTk9Sa0ZwVEVOS2RtTkhWbmxaV0ZKd1ltMWtabGx1U21oaWJWRnBUMmxLVTFGc1RXbE1RMHAyWTIxa1ptSnRSblJhVTBrMlNXczFhR1JIYkhaaWJVWnpTVVprYkdNelVuUmhWelY2WkVkV2VVbEZTbWhpYlhOblZVZDRha2xwZDJsYVdHaDNTV3B2ZUU1cVJYZE9hazE1VGtSQk1reERTbkJaV0ZGcFQycEZNazFVUVRKTmVrbDRUVlJGYzBsdFJuQmpNMEptWTBkV2VXSlhiSHBqTW14MlltdzViV0pIUm01SmFuQjFaRmQ0YzB4RFNuWmliRGxwV2xkb2FHSkhXbVppTWxscFQybEtNRnBZVGpCU1IxWnpXbGRrYUdSSFZsTlJiRTFwVEVOS2FHUlhVV2xQYVVwMldXNUthV041TlhaalIxWjFXVzFHZFdFeWJIVmFlVEZvWkZoU2IyVnBOWFpqUjFaMVdXMUdkV0V5YkhWYWVURm9aRmhTYjJWcE1YcGtSMFoxV2tkR2MySXlOV3hKYVhkcFpFY3hORmd6VG14ak0wNW1ZVmRSYVU5dE5URmlSM2R6U1cxNGNHSnRkR3hhUmpscVlWYzBhVTlwU1hkSmFYZHBXVEpLZDJGWGJHWmpSMVo1WWxkc2VtTXliSFppYkRsdFlrZEdia2xxY0hWa1YzaHpURU5LZVZwWFpIQmpNMUo1V1ZoU2NHSXlOV1phUjBZd1dsTkpObUp1Vm5OaVEzZHBZekk1YldSSVpHaGpiVlptWWtjNWJtSXhPVEZqYld0cFQybEtiMlJJVW5kamVtOTJUREpTYkdSdFZuTmlNMEpzWTJrMWRWbFlVak5hV0U0d1RHMU9kbUpUT1d0a1Z6RjBaVlk1YzJJeVpIWk1ia0oxV25sSmMwbHRPWGxhTVRsd1drTkpOa2xxUVhkTlZGVTBUVVJCZDAxRVFuRmFibVEwVjBWR1FsVlRTWE5KYlU1MlkyNUtiR0pIUmpCaFZ6bDFXREpzYTBscWIybE9ha0UxVFdwUk1VOVVRWHBOZW1kNlRtcGplazE2VlRST2VrbDRUVlJSZDAxVVJYcE9SR013VGxSSk5FOURTWE5KYlU1MlltNU9iR0p1VW1aak0xSm9aRWhXZWtscWIybGxNWGRwVWtkV2FtSkhiSFZhVm5kcFQyeDNhVTFVV1RSTk1rbDVUbFJSTVZsWFJYaFphbWN3V21wQk5VMVhWbWhPVkZaclRrUk9iVnBIVW10T1JGcGpTV2w0WTBscldtaGhWM2d4WTIxV1kwbHFjR05KYW1kNVQxZEdhMXBFV210YVYxa3lXWHBqTTAxdFJtdE5iVkpxVFdwcmVFNTZSVFJOYWs1cFRVUkthRmhEU1hOWVEwcENZa2Q0ZG1ReGQybFBiSGRwV20xYWFrNXFSVEJQUjFaclRVUm5lbHBVU20xWmJWbDRUbFJaTUU1WFNUVk5NazVxV1ZSUmVFMHlTbU5KYmpCcFRFTktlbUl5V2pCa01rWjVXbFk1ZVdJeWVHeGplVWsyU1d4MFVWTldUbEZNUTBKQ1UxWk9VVmhUU1hOSmJsSjBaVVk1ZG1OdFpHWmhWMUZwVDIwMU1XSkhlRGt1YWpZeE0xWm9kMGcyYUV4Q2EzZEJOazVWVG1kMVFYRkZSWEZFTTBwYVpYWlhUMGd3YVV4aGJVcHpSRUkyVEVvdFMzY3ljbEZ4VDJ0VFkycHFZbXRUV1c4MVIxbG1hbGgxWTBoYWNuTlpORzR0YWpkZldtY2lMQ0p0YzE5dFpYTnpZV2RsWDJoaGMyZ2lPaUprT0RZNE9ERXpNMlJqTkRVMlpqZzNOemt3WWpJNVlqbGlaR0kwWWpCa1lqYzFZek5tT1RRMk5HSXhaREpsT1dJd1pXUXlZamxsWXpOa09UazBOVGxsSW4wLmNDNjFiVk1zcVNUWFBRd0ZHclU0cmhXVHNUbGI4YXktOG1lT3gtXzZUQ2d3SHFpbHBsZFhWLXFGYzQyNTZrWWxOU2JYcGxjZ0FqRjc0cEwtelg1a2tzZk9sdzFIUUNsLW16REZveE1VTGd1ZFcwZkJPYzNMekxJWFM3cG40LTZFLVlzdktPVmV2Ymg2NFRBUF9SNzRIX2pNQUVJeXVIc25IeXlfU09Hd1NmWnFwdTBwa0M4enF6ZjBMVjBRS21RS2hTUW9sZkI3U2J0dmNDc19LcG80S3hPdFhmbUVFMlRDMGZKTkJ2cnR4dVZGa0hTdV83REtCYUZmSmNEYmdhZGVkZ2xBOGVMWmNqRzNFY3hlcng4QVFGZVRZTzlOV0xKNU12dW9UWkd2ZjdzTVFSRGMtdGphUVdsODlRdG5pQzFxSXlZTUFGOU1TcG9IcWxmOXMweXJVdyIsIm1zX21lc3NhZ2VfaGFzaCI6IjE5ODg0M2FmOTQyOTcyOGQxZTMyMDdmOGRjNmYzZGE4ZjI1ZWFkY2M5ZDQxY2ZhZWNhNTY5YjllNjY4MWZmOTYifQ.jKehsnGG5j1dOYWlwuF0vKGNbENI1HD35A9g89lhmMrkPhfZ8_lYw4lIkZ16Bepj6HZ53xnTtRXGtmcOZZMr0smh3l5SQ20-CZ6M0yT0wIUZYxJcXmR9_iR7zHI2SvVCpH5CWdlRUNQx9z51Z1SIjc5xvau19omCuMIz7YLZ2Py2tppKz04A8s2xA6Aox-th1dhuKE8NmhTzMnp6UUKbHFyw3Sf7BXJHvQlx4wPB1Pn5l0IZLnD078UsxNmI4r42tECAOmwa0POzzPntlcJNutQZ2QfB68F3YWQZ6YjKF4zTEcZjmMnqVKRLdTyJezGpzXEnitMrnXH-awztlN0d1A

将密钥部分单独带到本网站并制作PEM编码的公钥，然后在jwt.io中运行，签名验证！！！

https://8gwifi.org/jwkconvertfunctions.jsp

JWT 的 JWK 失败：

{
    "kty":"RSA",
    "kid":"236c88d1-5b51-4cd3-b73b-d6b4c1fbe177",
    "use":"sig",
    "n":"zVoCP5ZRqb_e5Vea_dvuNr0NAP_6K-x8Q5iV9ZaSjawp7mqmcDORTgUejrVvLUaeOO-xO4OLHRkqsb75R0VVIaB_hfTszCjo-CfQ5WUfH9tb3AVUP6bnx_l5VMWVrkYW1YVnaYqrJOD7axS9YXaVXgEixtHkwqNVLuCJ4Y6S1YxUCJZa4pCCOsPFd0tz4_mNLNUZRJUNuyK4v7AcsIlYqvl2J_G5cUCKFwSjaRBxPih-pd84dJIktU3xZeyZOMg_G5WiUujoyf20Fx5avLKV79F31dNBGUIVvu9woQb3mH00IULTJj1HhKjZkyJ16cvkiJ2G1jUk6r4v0cWc652uZw",
    "e":"AQAB"
}

================================================ ========== 成功验证的第二个令牌

eyJraWQiOiJlZTJkZWY1Mi1hZmQxLTQxMGUtOWFhOC0wODYzMzYyMzRlOTMiLCJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJlYzlmZWI2Zi1jZDdmLTRlZTctOWY1OS04ZGUzMTNhZDU2YzAiLCJhdWQiOiJyYnNnLm9wZW5iYW5raW5nLnNpdC5vZmZlcnMtdjEiLCJpc3MiOiJyYnNnLm9wZW5iYW5raW5nLnNpdC5hY2NvdW50cy12MyIsImV4cCI6MTYxMDcxNjE2NiwiaWF0IjoxNjEwNzE1ODY2LCJuYmYiOjE2MTA3MTU4NjYsIm1zX3Byb3BhZ2F0ZWRfand0IjoiZXlKcmFXUWlPaUkwWkRVNE5ETTRZeTFpWW1WaUxUUXlaR0l0WW1FMlpDMDROekE0TWpkbVlqRTFPVE1pTENKMGVYQWlPaUpLVjFRaUxDSmhiR2NpT2lKU1V6STFOaUo5LmV5SnpkV0lpT2lJd01UQTROVGd3TURRNUlpd2ljMjltZEhkaGNtVmZZMnhwWlc1MFgyNWhiV1VpT2lKRVJWTWdSMlZ1WlhKcFl5QjBaWE4wSUdOc2FXVnVkQ0JPVjBJaUxDSnBjM01pT2lKeVluTXVZWEJwWjJWbExuTnBkQ0lzSW1Ga1pHbDBhVzl1WVd4ZlkyeGhhVzF6SWpwN0ltTnVaaUk2SW50Y0luZzFkQ05UTWpVMlhDSTZYQ0l4UWtWRVFqTkZOVUZEUWtZek5UTkNNRGcwTWpWRVEwTTNOak5ETVRJeFFqVkZNVU0wT1RFMlhDSjlJaXdpYkdsdWEyVmtYMk5wYmlJNklqQWlMQ0pqYjI1elpXNTBYM04wWVhSMWN5STZJazVjTDBFaUxDSmhZM0lpT2lKMWNtNDZiM0JsYm1KaGJtdHBibWM2Y0hOa01qcHpZMkVpTENKamIzSnlaV3hoZEdsdmJsOXBaQ0k2SWpVM05qazVNVEV3TURZM05UZzBOVE0yTlRBeU1URTFNREV4TXpBeE5UUTBNemNpTENKamRYTjBYM1I1Y0dVaU9pSlFSVkpUVDA1QlRDSXNJbUpwYmlJNklqRTRNVGMyT1RNMU56QWlMQ0p2Y0dWdVltRnVhMmx1WjE5cGJuUmxiblJmYVdRaU9pSXpORFkwWkRrMk16WTNZakUwT1RWaU9UTTJNelUwT1RFd09XTm1ZelE1TmlJc0ltOXdaWEpoZEdsdVoxOWljbUZ1WkNJNklsSkNVeUlzSW5WelpYSmZZWFYwYUc1ZmJXVjBhRzlrSWpvaWFXRnRMWEkwY0MxM1pXSWlMQ0p6YjJaMGQyRnlaVjl5YjJ4bGN5STZXeUpRU1ZOUUlpd2lRVWxUVUNKZExDSmphVzRpT2lJeE1EVTVORGM1TlRnNEluMHNJbU5zYVdWdWRGOXBaQ0k2SWpaNFVGVkllRzFUYlU0NGJHWk1Na1ppZW5WNE0zTWlMQ0p6YjJaMGQyRnlaVjlwWkNJNklqWjRVRlZJZUcxVGJVNDRiR1pNTWtaaWVuVjRNM01pTENKaGRXUWlPaUp5WW5ObkxtOXdaVzVpWVc1cmFXNW5Mbk5wZEM1aFkyTnZkVzUwY3kxMk15SXNJbTl5WjE5cFpDSTZJakF3TVRVNE1EQXdNREJxWm5kNFdFRkJVU0lzSW5OamIzQmxJam9pYjNCbGJtbGtJR0ZqWTI5MWJuUnpJaXdpYjNCbGNtRjBhVzVuWDJKeVlXNWtJam9pY21Keklpd2liM0puWDI1aGJXVWlPaUpPWVhScGIyNWhiQ0JYWlhOMGJXbHVjM1JsY2lCQ1lXNXJJRkJzWXlJc0ltVjRjQ0k2TVRZeE1EY3hOVGt5TlN3aWFXRjBJam94TmpFd056RTFPRFkxTENKcWRHa2lPaUkyWXpNMU5UTmxOUzFqWW1GaExUUXdNV1l0T1RaaU15MHpNREUxWlROaVlUYzRaRFVpZlEuRUh0Q2JhYUE1amN4OHNXZTNaU3dndVR0QkxQc3pxQ1ZBRmJrcm5rUmdRdVYtUVdyTHFFMTNidUVnY0Z5eFF3dlNxcFhZR2dyeTVKMXh0YlJYOFhxZzNmdzFOWXppMms4cWlUNm12WFJoUDVtSDJySVVVVE1FVUt2TW1maFlRWlRtdGNDcS1NYnZ5UzRkWURhR3NXbnZ0Y1U5cHYxYUxYT21ydFUwdmhrVlpaNUwyakJnRTdFOWZ2amZMZE5oUERacGpINGpjNHJaY1VhMmc3clVlMEJoNTY2WURhQ2txS2J6VjBuRDRWV0hLOERsX19jNU1FNVpLMkFJSnJTd3RBQkhtaElwWUV1N1JhUWlPd1ZBRFRNd0ZfcWRJeU1jdVM1dVhtZk1uTi0xcFFOREV2ZzN6MmhvNzJTNjVkS0x5Y0JfejA1b1lwMGUybWw1ZHBFaDZjNUdnIiwibXNfbWVzc2FnZV9oYXNoIjoiYTliMWIwZGNmOTkxYzUyOGFjYWFmNTI0OTMxMGEyYWVhOTM3MGM1NjFjZDdmMjliNDY4MzQzM2YwYjg0YWIzYyJ9.PTZjUdQ386cC5AloVW5UCXtmHqYZD7zo4JisAjZIQdGowxDR0HfnZ8TEDwb20c7HmYHXUmnP971vYNoI4gEifFWVmiEbiFxKgp1pR68LyqC-qclJApB8jLrMFfSxKiwgKIyLkLqBg6XTGonOVJZcLi3--UD7fiRxj-s-Oq1kH7s3lqyp3-C6oLDHiVZmHfFtOaZQFGFGUhmDCodkMNEGeGm28hyMNZXpB0kgA8FQehEhfMAUe1yHA2hgzONNn4eMAYnVMBb7Ax4pMxHQKbhPP15vU4AOWI4xo1VFZrWtydI9yvFggJu_S_pu5c6Z8PywKMGHZjhh-XaCouVG85Z_PQ

它的 PEM 公钥：

它的 JWK：

{
   "kty":"RSA",
   "kid":"ee2def52-afd1-410e-9aa8-086336234e93",
   "n":"hL1hBsWFuD4oXZ6SELvibUcv9ap7QDBVZv5BZzGOyjsGmKXumi3UsfAHhhMPC3r9jt6tUsbsp4ahvuBS-9lKlOk45DtJW4aQRI2k24KAyniwFNweBy1gJny9jrDYHJ7Vot0hkIT86oMqM6gVnbLVqzrNuQGA-zpB6Crlpzr8z094j7h-KcHTaPJh_qTZq_IUE3xxC0oPfGFYUohWeEjYBx7yq3jkMVXEQ9POtcTY9ttNCg9f9MpeNO1la_YMRsiEzJDLEnAtskndTfw6AwadfN7VZXKHaajFkBulRwZkxo8JusHCQzNWctbfHTYpsvKZBMHTRAjbrTzEE8Ps0x_ToQ",
   "e":"AQAB"
}

【问题讨论】：

该问题是由同时修复的错误引起的。但是，您使用的是库 github.com/lestrrat/go-jwx 的存档过时版本，它仍然包含错误。正确的存储库是github.com/lestrrat-go/jwx，这里的错误已修复，另请参阅 lestrrat 的答案。

标签： go cryptography jwt jwk

【解决方案1】：

我制作了一个包，用于在使用 JWKS 时帮助解析和验证 JWT：github.com/MicahParks/keyfunc

此包与最流行的 JWT 包github.com/dgrijalva/jwt-go 一起使用。

如果您将 JSON Web 密钥 JWK 放入 JSON Web 密钥集 JWKS，它将如下所示：

{
  "keys": [
    {
      "kty": "RSA",
      "kid": "236c88d1-5b51-4cd3-b73b-d6b4c1fbe177",
      "use": "sig",
      "n": "zVoCP5ZRqb_e5Vea_dvuNr0NAP_6K-x8Q5iV9ZaSjawp7mqmcDORTgUejrVvLUaeOO-xO4OLHRkqsb75R0VVIaB_hfTszCjo-CfQ5WUfH9tb3AVUP6bnx_l5VMWVrkYW1YVnaYqrJOD7axS9YXaVXgEixtHkwqNVLuCJ4Y6S1YxUCJZa4pCCOsPFd0tz4_mNLNUZRJUNuyK4v7AcsIlYqvl2J_G5cUCKFwSjaRBxPih-pd84dJIktU3xZeyZOMg_G5WiUujoyf20Fx5avLKV79F31dNBGUIVvu9woQb3mH00IULTJj1HhKjZkyJ16cvkiJ2G1jUk6r4v0cWc652uZw",
      "e": "AQAB"
    },
    {
      "kty": "RSA",
      "kid": "ee2def52-afd1-410e-9aa8-086336234e93",
      "n": "hL1hBsWFuD4oXZ6SELvibUcv9ap7QDBVZv5BZzGOyjsGmKXumi3UsfAHhhMPC3r9jt6tUsbsp4ahvuBS-9lKlOk45DtJW4aQRI2k24KAyniwFNweBy1gJny9jrDYHJ7Vot0hkIT86oMqM6gVnbLVqzrNuQGA-zpB6Crlpzr8z094j7h-KcHTaPJh_qTZq_IUE3xxC0oPfGFYUohWeEjYBx7yq3jkMVXEQ9POtcTY9ttNCg9f9MpeNO1la_YMRsiEzJDLEnAtskndTfw6AwadfN7VZXKHaajFkBulRwZkxo8JusHCQzNWctbfHTYpsvKZBMHTRAjbrTzEE8Ps0x_ToQ",
      "e": "AQAB"
    }
  ]
}

这是一个完整示例，说明如何使用原始帖子中的 JWK 构建的 JWKS 解析和验证 JWT：

package main

import (
    "log"

    "github.com/MicahParks/keyfunc"
    "github.com/dgrijalva/jwt-go"
)

const (

    // The two combined JWK from the original post as a JWKS.
    jwksJSON = `{"keys":[{"kty":"RSA","kid":"236c88d1-5b51-4cd3-b73b-d6b4c1fbe177","use":"sig","n":"zVoCP5ZRqb_e5Vea_dvuNr0NAP_6K-x8Q5iV9ZaSjawp7mqmcDORTgUejrVvLUaeOO-xO4OLHRkqsb75R0VVIaB_hfTszCjo-CfQ5WUfH9tb3AVUP6bnx_l5VMWVrkYW1YVnaYqrJOD7axS9YXaVXgEixtHkwqNVLuCJ4Y6S1YxUCJZa4pCCOsPFd0tz4_mNLNUZRJUNuyK4v7AcsIlYqvl2J_G5cUCKFwSjaRBxPih-pd84dJIktU3xZeyZOMg_G5WiUujoyf20Fx5avLKV79F31dNBGUIVvu9woQb3mH00IULTJj1HhKjZkyJ16cvkiJ2G1jUk6r4v0cWc652uZw","e":"AQAB"},{"kty":"RSA","kid":"ee2def52-afd1-410e-9aa8-086336234e93","n":"hL1hBsWFuD4oXZ6SELvibUcv9ap7QDBVZv5BZzGOyjsGmKXumi3UsfAHhhMPC3r9jt6tUsbsp4ahvuBS-9lKlOk45DtJW4aQRI2k24KAyniwFNweBy1gJny9jrDYHJ7Vot0hkIT86oMqM6gVnbLVqzrNuQGA-zpB6Crlpzr8z094j7h-KcHTaPJh_qTZq_IUE3xxC0oPfGFYUohWeEjYBx7yq3jkMVXEQ9POtcTY9ttNCg9f9MpeNO1la_YMRsiEzJDLEnAtskndTfw6AwadfN7VZXKHaajFkBulRwZkxo8JusHCQzNWctbfHTYpsvKZBMHTRAjbrTzEE8Ps0x_ToQ","e":"AQAB"}]}`
)

func main() {

    // Create the JWKS from hardcoded JSON.
    //
    // This can also be done via an HTTPS resource using the keyfunc.Get function.
    jwks, err := keyfunc.New([]byte(jwksJSON))
    if err != nil {
        log.Fatalf("Failed to create JWKS from JSON.\nError: %s", err.Error())
    }

    // The "failing" JWT from the original post.
    jwtB64 := "eyJraWQiOiIyMzZjODhkMS01YjUxLTRjZDMtYjczYi1kNmI0YzFmYmUxNzciLCJhbGciOiJSUzI1NiJ9.eyJqdGkiOiIzZTRkNDA5My04M2U2LTRiZGYtODkwYi1kNDBhYjgyMTE0MzkiLCJhdWQiOiJvYnJicy5vcGVuYmFua2luZy1jb25zZW50Lm9wZW5iYW5raW5nLWNvbnNlbnQtc3RhbmRhbG9uZSIsImlzcyI6InJic2cub3BlbmJhbmtpbmcuc2l0LnBheW1lbnRzLWxpbWl0cy12MSIsImV4cCI6MTYxMDYzMjQxNSwiaWF0IjoxNjEwNjMyMTE1LCJuYmYiOjE2MTA2MzIxMTUsIm1zX3Byb3BhZ2F0ZWRfand0IjoiZXlKcmFXUWlPaUpsT0dRMk1HSXlZaTB5T1RFeUxUUmpNamd0T0RNeE55MWhOemszT1dZeFlUVmtOamdpTENKaGJHY2lPaUpTVXpJMU5pSjkuZXlKcWRHa2lPaUpsTkRaa1l6VXdPQzAxWXpKaUxUUXhaall0WW1ZMU1TMWtZVE0yTVRKak9UWTVOak1pTENKaGRXUWlPaUp5WW5ObkxtOXdaVzVpWVc1cmFXNW5Mbk5wZEM1d1lYbHRaVzUwY3kxc2FXMXBkSE10ZGpFaUxDSnBjM01pT2lKdlluSmljeTV2Y0dWdVltRnVhMmx1WnkxaGRYUm9laTV2Y0dWdVltRnVhMmx1WnkxaGRYUm9laTF6ZEdGdVpHRnNiMjVsSWl3aVpYaHdJam94TmpFd05qTXlNVFF6TENKcFlYUWlPakUyTVRBMk16SXhNVE1zSW01aVppSTZNVFl4TURZek1qRXhNeXdpYlhOZmNISnZjR0ZuWVhSbFpGOXFkM1FpT2lKbGVVcHlZVmRSYVU5cFNUVmpRMGx6U1cxR2MxcDVTVFpKYTFaVVRXcFZNa2x1TUM1bGVVcDZaRmRKYVU5cFNYZE5WRUUwVGxSbmQwMUVVVFZKYVhkcFl6STViV1JJWkdoamJWWm1XVEo0Y0ZwWE5UQllNalZvWWxkVmFVOXBTa1ZTVmsxblVqSldkVnBZU25CWmVVSXdXbGhPTUVsSFRuTmhWMVoxWkVOQ1QxWXdTV2xNUTBwcFlWYzBhVTlwU1hoUFJFVXpUbXByZWs1VVkzZEphWGRwWVZoT2VrbHFiMmxWUjJ4MVdqQkdhbGt5Vm5wak1FWXhaRWRvVldJeWRHeGlhVWx6U1c1T2RscHVVak5aV0Vwc1dETlNkbU14T1RGamJXdHBUMmxLYjJSSVVuZGplbTkyVERKU2JHUnRWbk5pTTBKc1kyazFkVmxZVWpOYVdFNHdURzFPZG1KVE9XdGtWekYwWlZZNU1GcFlTblJqZVRWdlpFY3dhVXhEU21waFZ6UnBUMmxKZUUxRVZUVk9SR00xVGxSbk5FbHBkMmxrUjJoNVdsZEdNRmd6U214Wk1qbDVXa1k1ZVZwWVRqRmlTRkZwVDJsS1IxbFhiSE5rV0Vwc1NXbDNhV050Vm5wa1Z6RnNXRE5XZVdKRFNUWkpiV2d3WkVoQ2VrOXBPSFpoVjBaMFRGZEdNV1JIYUhWTVdFNXdaRU14ZVZsdVRYVmlWMFoxV1Zka2JGcElVbXhqTTFGMVdUSTVkRXd5Um5wTU0yUlpVMFprUTB3elNteGpNMVowV2xNNWFHTjVPV2hrV0ZKdllqTktjR1Z0UmpCaFZ6bDFURzVDY0dKdFkybE1RMHAzWVZoT2QxZ3pRbXhqYlRGd1l6Tk9jR0l5TldaYWJYaG9XbmxKTm1KdVZuTmlRM2RwV1RKNGNGcFhOVEJZTW14clNXcHZhVTV1YUZGV1ZXZzBZbFpPZEZScWFITmFhM2Q1VW0xS05tUllaM3BqZVVselNXNVNkR1ZHT1hwa1dFSjNZMjFXZW1NeWJIWmliRGx0WWtkR2JrbHFjSFZrVjNoelRFTktlbUl5V2pCa01rWjVXbFk1ZDJJeWVIQlpNMnhtWkZoS2NFbHFiMmxoU0ZJd1kwaE5Oa3g1T1d0YVdGcHNZa2M1ZDFwWVNYVmliVVl3WkRKV2VtUkROV3BpTWpCMldraFdkR0pZYkdaalJ6bHpZVmRPTlV4dGFEQmlVMGx6U1c1V2VscFlTbVpaV0ZZd1lVYzFabUpYVmpCaFJ6bHJTV3B2YVdGWFJuUk1XRWt3WTBNeE0xcFhTV2xNUTBwNllqSmFNR1F5Um5sYVZqbHdXa05KTmtscVdqUlZSbFpKWlVjeFZHSlZORFJpUjFwTlRXdGFhV1Z1VmpSTk0wMXBURU5LZG1OSFZuVlpiVVoxWVRKc2RWb3hPWEJpYmxKc1ltNVNabUZYVVdsUGFVcHFUa1JyZVU1RVVUTmFha1UwV1cxRk1FOUVSbWxaYWtFd1RrUkpORmx0VFhwUFYwVXhXVlJSTUUxcFNYTkpibEo2VFd3NWFGa3lUblprVnpVd1dESnNhMGxxYjJsVWFUbENTV2wzYVdSWVRteGpiRGt3WlZoQ2JFbHFiMmxVYVRsQ1NXbDNhVmt6Vm5wa1Jqa3daVmhDYkVscWIybFZSVlpUVlRBNVQxRlZkMmxNUTBwb1pGaFNiMkpzT1hSYVdGSnZZakpSYVU5cFNsTk9Sa0ZwVEVOS2RtTkhWbmxaV0ZKd1ltMWtabGx1U21oaWJWRnBUMmxLVTFGc1RXbE1RMHAyWTIxa1ptSnRSblJhVTBrMlNXczFhR1JIYkhaaWJVWnpTVVprYkdNelVuUmhWelY2WkVkV2VVbEZTbWhpYlhOblZVZDRha2xwZDJsYVdHaDNTV3B2ZUU1cVJYZE9hazE1VGtSQk1reERTbkJaV0ZGcFQycEZNazFVUVRKTmVrbDRUVlJGYzBsdFJuQmpNMEptWTBkV2VXSlhiSHBqTW14MlltdzViV0pIUm01SmFuQjFaRmQ0YzB4RFNuWmliRGxwV2xkb2FHSkhXbVppTWxscFQybEtNRnBZVGpCU1IxWnpXbGRrYUdSSFZsTlJiRTFwVEVOS2FHUlhVV2xQYVVwMldXNUthV041TlhaalIxWjFXVzFHZFdFeWJIVmFlVEZvWkZoU2IyVnBOWFpqUjFaMVdXMUdkV0V5YkhWYWVURm9aRmhTYjJWcE1YcGtSMFoxV2tkR2MySXlOV3hKYVhkcFpFY3hORmd6VG14ak0wNW1ZVmRSYVU5dE5URmlSM2R6U1cxNGNHSnRkR3hhUmpscVlWYzBhVTlwU1hkSmFYZHBXVEpLZDJGWGJHWmpSMVo1WWxkc2VtTXliSFppYkRsdFlrZEdia2xxY0hWa1YzaHpURU5LZVZwWFpIQmpNMUo1V1ZoU2NHSXlOV1phUjBZd1dsTkpObUp1Vm5OaVEzZHBZekk1YldSSVpHaGpiVlptWWtjNWJtSXhPVEZqYld0cFQybEtiMlJJVW5kamVtOTJUREpTYkdSdFZuTmlNMEpzWTJrMWRWbFlVak5hV0U0d1RHMU9kbUpUT1d0a1Z6RjBaVlk1YzJJeVpIWk1ia0oxV25sSmMwbHRPWGxhTVRsd1drTkpOa2xxUVhkTlZGVTBUVVJCZDAxRVFuRmFibVEwVjBWR1FsVlRTWE5KYlU1MlkyNUtiR0pIUmpCaFZ6bDFXREpzYTBscWIybE9ha0UxVFdwUk1VOVVRWHBOZW1kNlRtcGplazE2VlRST2VrbDRUVlJSZDAxVVJYcE9SR013VGxSSk5FOURTWE5KYlU1MlltNU9iR0p1VW1aak0xSm9aRWhXZWtscWIybGxNWGRwVWtkV2FtSkhiSFZhVm5kcFQyeDNhVTFVV1RSTk1rbDVUbFJSTVZsWFJYaFphbWN3V21wQk5VMVhWbWhPVkZaclRrUk9iVnBIVW10T1JGcGpTV2w0WTBscldtaGhWM2d4WTIxV1kwbHFjR05KYW1kNVQxZEdhMXBFV210YVYxa3lXWHBqTTAxdFJtdE5iVkpxVFdwcmVFNTZSVFJOYWs1cFRVUkthRmhEU1hOWVEwcENZa2Q0ZG1ReGQybFBiSGRwV20xYWFrNXFSVEJQUjFaclRVUm5lbHBVU20xWmJWbDRUbFJaTUU1WFNUVk5NazVxV1ZSUmVFMHlTbU5KYmpCcFRFTktlbUl5V2pCa01rWjVXbFk1ZVdJeWVHeGplVWsyU1d4MFVWTldUbEZNUTBKQ1UxWk9VVmhUU1hOSmJsSjBaVVk1ZG1OdFpHWmhWMUZwVDIwMU1XSkhlRGt1YWpZeE0xWm9kMGcyYUV4Q2EzZEJOazVWVG1kMVFYRkZSWEZFTTBwYVpYWlhUMGd3YVV4aGJVcHpSRUkyVEVvdFMzY3ljbEZ4VDJ0VFkycHFZbXRUV1c4MVIxbG1hbGgxWTBoYWNuTlpORzR0YWpkZldtY2lMQ0p0YzE5dFpYTnpZV2RsWDJoaGMyZ2lPaUprT0RZNE9ERXpNMlJqTkRVMlpqZzNOemt3WWpJNVlqbGlaR0kwWWpCa1lqYzFZek5tT1RRMk5HSXhaREpsT1dJd1pXUXlZamxsWXpOa09UazBOVGxsSW4wLmNDNjFiVk1zcVNUWFBRd0ZHclU0cmhXVHNUbGI4YXktOG1lT3gtXzZUQ2d3SHFpbHBsZFhWLXFGYzQyNTZrWWxOU2JYcGxjZ0FqRjc0cEwtelg1a2tzZk9sdzFIUUNsLW16REZveE1VTGd1ZFcwZkJPYzNMekxJWFM3cG40LTZFLVlzdktPVmV2Ymg2NFRBUF9SNzRIX2pNQUVJeXVIc25IeXlfU09Hd1NmWnFwdTBwa0M4enF6ZjBMVjBRS21RS2hTUW9sZkI3U2J0dmNDc19LcG80S3hPdFhmbUVFMlRDMGZKTkJ2cnR4dVZGa0hTdV83REtCYUZmSmNEYmdhZGVkZ2xBOGVMWmNqRzNFY3hlcng4QVFGZVRZTzlOV0xKNU12dW9UWkd2ZjdzTVFSRGMtdGphUVdsODlRdG5pQzFxSXlZTUFGOU1TcG9IcWxmOXMweXJVdyIsIm1zX21lc3NhZ2VfaGFzaCI6IjE5ODg0M2FmOTQyOTcyOGQxZTMyMDdmOGRjNmYzZGE4ZjI1ZWFkY2M5ZDQxY2ZhZWNhNTY5YjllNjY4MWZmOTYifQ.jKehsnGG5j1dOYWlwuF0vKGNbENI1HD35A9g89lhmMrkPhfZ8_lYw4lIkZ16Bepj6HZ53xnTtRXGtmcOZZMr0smh3l5SQ20-CZ6M0yT0wIUZYxJcXmR9_iR7zHI2SvVCpH5CWdlRUNQx9z51Z1SIjc5xvau19omCuMIz7YLZ2Py2tppKz04A8s2xA6Aox-th1dhuKE8NmhTzMnp6UUKbHFyw3Sf7BXJHvQlx4wPB1Pn5l0IZLnD078UsxNmI4r42tECAOmwa0POzzPntlcJNutQZ2QfB68F3YWQZ6YjKF4zTEcZjmMnqVKRLdTyJezGpzXEnitMrnXH-awztlN0d1A"

    // Parse the JWT.
    var token *jwt.Token
    if token, err = jwt.Parse(jwtB64, jwks.KeyFunc); err != nil {
        log.Printf("Failed to parse \"failing\" JWT from original post.\nError: %s", err.Error())
        // TODO Exit program.
    } else {

        // Confirm the token is valid.
        if !token.Valid {
            log.Println(`The "failing" token from the original post is not valid.`)
        }
    }

    // The second token from the original post.
    jwtB64 = "eyJraWQiOiJlZTJkZWY1Mi1hZmQxLTQxMGUtOWFhOC0wODYzMzYyMzRlOTMiLCJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJlYzlmZWI2Zi1jZDdmLTRlZTctOWY1OS04ZGUzMTNhZDU2YzAiLCJhdWQiOiJyYnNnLm9wZW5iYW5raW5nLnNpdC5vZmZlcnMtdjEiLCJpc3MiOiJyYnNnLm9wZW5iYW5raW5nLnNpdC5hY2NvdW50cy12MyIsImV4cCI6MTYxMDcxNjE2NiwiaWF0IjoxNjEwNzE1ODY2LCJuYmYiOjE2MTA3MTU4NjYsIm1zX3Byb3BhZ2F0ZWRfand0IjoiZXlKcmFXUWlPaUkwWkRVNE5ETTRZeTFpWW1WaUxUUXlaR0l0WW1FMlpDMDROekE0TWpkbVlqRTFPVE1pTENKMGVYQWlPaUpLVjFRaUxDSmhiR2NpT2lKU1V6STFOaUo5LmV5SnpkV0lpT2lJd01UQTROVGd3TURRNUlpd2ljMjltZEhkaGNtVmZZMnhwWlc1MFgyNWhiV1VpT2lKRVJWTWdSMlZ1WlhKcFl5QjBaWE4wSUdOc2FXVnVkQ0JPVjBJaUxDSnBjM01pT2lKeVluTXVZWEJwWjJWbExuTnBkQ0lzSW1Ga1pHbDBhVzl1WVd4ZlkyeGhhVzF6SWpwN0ltTnVaaUk2SW50Y0luZzFkQ05UTWpVMlhDSTZYQ0l4UWtWRVFqTkZOVUZEUWtZek5UTkNNRGcwTWpWRVEwTTNOak5ETVRJeFFqVkZNVU0wT1RFMlhDSjlJaXdpYkdsdWEyVmtYMk5wYmlJNklqQWlMQ0pqYjI1elpXNTBYM04wWVhSMWN5STZJazVjTDBFaUxDSmhZM0lpT2lKMWNtNDZiM0JsYm1KaGJtdHBibWM2Y0hOa01qcHpZMkVpTENKamIzSnlaV3hoZEdsdmJsOXBaQ0k2SWpVM05qazVNVEV3TURZM05UZzBOVE0yTlRBeU1URTFNREV4TXpBeE5UUTBNemNpTENKamRYTjBYM1I1Y0dVaU9pSlFSVkpUVDA1QlRDSXNJbUpwYmlJNklqRTRNVGMyT1RNMU56QWlMQ0p2Y0dWdVltRnVhMmx1WjE5cGJuUmxiblJmYVdRaU9pSXpORFkwWkRrMk16WTNZakUwT1RWaU9UTTJNelUwT1RFd09XTm1ZelE1TmlJc0ltOXdaWEpoZEdsdVoxOWljbUZ1WkNJNklsSkNVeUlzSW5WelpYSmZZWFYwYUc1ZmJXVjBhRzlrSWpvaWFXRnRMWEkwY0MxM1pXSWlMQ0p6YjJaMGQyRnlaVjl5YjJ4bGN5STZXeUpRU1ZOUUlpd2lRVWxUVUNKZExDSmphVzRpT2lJeE1EVTVORGM1TlRnNEluMHNJbU5zYVdWdWRGOXBaQ0k2SWpaNFVGVkllRzFUYlU0NGJHWk1Na1ppZW5WNE0zTWlMQ0p6YjJaMGQyRnlaVjlwWkNJNklqWjRVRlZJZUcxVGJVNDRiR1pNTWtaaWVuVjRNM01pTENKaGRXUWlPaUp5WW5ObkxtOXdaVzVpWVc1cmFXNW5Mbk5wZEM1aFkyTnZkVzUwY3kxMk15SXNJbTl5WjE5cFpDSTZJakF3TVRVNE1EQXdNREJxWm5kNFdFRkJVU0lzSW5OamIzQmxJam9pYjNCbGJtbGtJR0ZqWTI5MWJuUnpJaXdpYjNCbGNtRjBhVzVuWDJKeVlXNWtJam9pY21Keklpd2liM0puWDI1aGJXVWlPaUpPWVhScGIyNWhiQ0JYWlhOMGJXbHVjM1JsY2lCQ1lXNXJJRkJzWXlJc0ltVjRjQ0k2TVRZeE1EY3hOVGt5TlN3aWFXRjBJam94TmpFd056RTFPRFkxTENKcWRHa2lPaUkyWXpNMU5UTmxOUzFqWW1GaExUUXdNV1l0T1RaaU15MHpNREUxWlROaVlUYzRaRFVpZlEuRUh0Q2JhYUE1amN4OHNXZTNaU3dndVR0QkxQc3pxQ1ZBRmJrcm5rUmdRdVYtUVdyTHFFMTNidUVnY0Z5eFF3dlNxcFhZR2dyeTVKMXh0YlJYOFhxZzNmdzFOWXppMms4cWlUNm12WFJoUDVtSDJySVVVVE1FVUt2TW1maFlRWlRtdGNDcS1NYnZ5UzRkWURhR3NXbnZ0Y1U5cHYxYUxYT21ydFUwdmhrVlpaNUwyakJnRTdFOWZ2amZMZE5oUERacGpINGpjNHJaY1VhMmc3clVlMEJoNTY2WURhQ2txS2J6VjBuRDRWV0hLOERsX19jNU1FNVpLMkFJSnJTd3RBQkhtaElwWUV1N1JhUWlPd1ZBRFRNd0ZfcWRJeU1jdVM1dVhtZk1uTi0xcFFOREV2ZzN6MmhvNzJTNjVkS0x5Y0JfejA1b1lwMGUybWw1ZHBFaDZjNUdnIiwibXNfbWVzc2FnZV9oYXNoIjoiYTliMWIwZGNmOTkxYzUyOGFjYWFmNTI0OTMxMGEyYWVhOTM3MGM1NjFjZDdmMjliNDY4MzQzM2YwYjg0YWIzYyJ9.PTZjUdQ386cC5AloVW5UCXtmHqYZD7zo4JisAjZIQdGowxDR0HfnZ8TEDwb20c7HmYHXUmnP971vYNoI4gEifFWVmiEbiFxKgp1pR68LyqC-qclJApB8jLrMFfSxKiwgKIyLkLqBg6XTGonOVJZcLi3--UD7fiRxj-s-Oq1kH7s3lqyp3-C6oLDHiVZmHfFtOaZQFGFGUhmDCodkMNEGeGm28hyMNZXpB0kgA8FQehEhfMAUe1yHA2hgzONNn4eMAYnVMBb7Ax4pMxHQKbhPP15vU4AOWI4xo1VFZrWtydI9yvFggJu_S_pu5c6Z8PywKMGHZjhh-XaCouVG85Z_PQ"

    // Parse the JWT.
    if token, err = jwt.Parse(jwtB64, jwks.KeyFunc); err != nil {
        log.Printf("Failed to parse the second token from the original post.\nError: %s", err.Error())
        // TODO Exit program.
    } else {

        // Confirm the token is valid.
        if !token.Valid {
            log.Println("The second token from the original post is not valid.")
        }
    }

}

【讨论】：