JWS Signature Verification fails when payload contains anything other than JSON

[jeanabraham]

Hi,

For the below JWS token verification:

local jwt_obj = jwt:verify(public_key_pem, jws_token)

    -- Check signature verification
    if jwt_obj.verified == false then
        local error_message = cjson.encode(jwt_obj)
        kong.log.err(error_message)
        return kong.response.exit(401, { message = error_message })
    end

The verify fails when the content of the payload is a base64url encoded value of a hexadecimal of a sha256 binary.

{"message":"{\"reason\":\"invalid payload: ZGM3NzZmMGQ2MjZlNWQyYTI2NmM5YTIwNzQ4Njc1NmE4MjRmNWRhNTcyZmQ2MGQ1ZTJlNzlkOTFmZmM0ZTNlNw\",\"verified\":false}"}

The same token verification works when the payload is a base64url encoded value of JSON.

Thanks in advance for any help!