Rest Service securization using JWT - jax-rs

Question

I am trying to implement a token-based authentication on my web service.
I followed this tutorial : Tutoriel
First, when I get a token from the web service and I test it here : Website to test JWT Token I got a the message : invalid signature
And when I tried to identify my token from my web service (between my application and the ws), this function throws an exception :
Unable to read JSON value: XXXX (some data...)
Here the code to generate a token :
private String issueToken(String username) {
SecretKey key = keyGenerator.generateKey();
String jwtToken = Jwts.builder()
.setSubject(username)
.setIssuer(context.getAbsolutePath().toString())
.setIssuedAt(new Date())
.setExpiration(Date.from(LocalDateTime.now().plusMinutes(60L).toInstant(ZoneOffset.UTC)))
.signWith(SignatureAlgorithm.HS512, key)
.compact();
return jwtToken;
}
And here the code to check if the sent token is valid :
#Override
public void filter(ContainerRequestContext requestContext) throws IOException {
// Get the HTTP Authorization header from the request
String authorizationHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION);
// Extract the token from the HTTP Authorization header
String token = "";
if(authorizationHeader != null)
token = authorizationHeader.substring("Bearer".length()).trim();
try {
// Validate the token
SecretKey key = keyGenerator.generateKey();
System.out.println(token);
System.out.println(key);
Jwts.parser().setSigningKey(key).parseClaimsJws(token);
} catch (Exception e) {
System.out.println(e.getMessage());
requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());
}
}
Thanks in advance.

Answer 1

Resolved, thanks to #jps :
"so your line "Token comparison" is the output from filter, right?! Then it's missing the first 6 characters, which explains the excpetion you get. The 6 characters get probably deleted in token = authorizationHeader.substring("Bearer".length()).trim(); . I guess you didn't add the word 'Bearer' to the request and now, instead of deleting 'Bearer' it deletes the first 6 characters of the token"