Flask and PyJWT retrieve authorization header

Question

There is a REST client that makes HTTP requests to the server. REST client sends a request which contains a header

Authorization=Bearer someValidBase64

Now I have a server application in Python 3.8, Flask 1.1.1, PyJWT==1.7.1.

@app.route(my_rest_end_point)
def get_service_payments():
    authorization_header = request.headers.get('Authorization')

    # It prints correctly: Bearer someValidBase64
    print("Authorization header:\n" + authorization_header)

    # Details from that header
    user_permissions = jwt.decode(authorization_header)

It fails with

File "/usr/local/lib/python3.7/site-packages/jwt/api_jws.py", line 188, in _load
    raise DecodeError('Invalid header padding')
jwt.exceptions.DecodeError: Invalid header padding

What I tried

authorization_header = request.headers.get('Authorization')
print("Authorization header:\n" + authorization_header)
cleared_header =  authorization_header[7:]
print("cleared_header:\n" + cleared_header)
user_permissions = jwt.decode(cleared_header)

It will print

Authorization header:
Bearer someValidBase64
cleared_header:
someValidBase64

It fails again because the token itself has structure someValidBase64.otherValidPart so there is a dot ..

Bearer is not part of the token, you should split the string and take only the token itself to the jwt.decode function — jps
– jps, Commented Jan 22, 2020 at 15:13

Karthick Mohanraj · Accepted Answer · 2020-01-23 10:24:46Z

2

Well, the problem is authorization_header consists of the value "Bearer someValidBase64". Now when you try to decode this, you are facing this error because the prefix "Bearer" is attached to it.

Make sure you store only the base64 part of the string inside authorization_header without the prefix so that you can decode it successfully.

Update:

As I understand, the authorization_header consists of a JWT token and since you're trying to decode a JWT token, make sure your authorization_header is in the format of xxxxx.yyyyy.zzzzz If you find it in any other format than this, make sure you strip the string so that only this format of the JWT token is extracted.

edited Jan 23, 2020 at 10:24

answered Jan 22, 2020 at 15:51

Karthick Mohanraj

1,6883 gold badges18 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Yan Khonski Over a year ago

I will try in a week

Collectives™ on Stack Overflow

Flask and PyJWT retrieve authorization header

What I tried

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

What I tried

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related