Merge pull request #5 from dnstapir/jws_verify_kid

Verify JWS with kid
dnstapir · Jun 14, 2024 · 2a931c9 · 2a931c9
2 parents 3b3e914 + 7dff2a2
commit 2a931c9
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/evrec/server.py b/evrec/server.py
@@ -1,5 +1,6 @@
 import argparse
 import asyncio
+import json
 import logging
 import logging.config
 import os
@@ -144,7 +145,12 @@ async def handle_payload(
 
 def verify_jws_with_keys(jws: JWS, keys: JWKSet) -> JWK:
     """Verify JWS using keys and return key (or raise JWKeyNotFound)"""
-    for key in keys:
+    protected_header = json.loads(jws.objects["protected"])
+    if kid := protected_header.get("kid"):
+        logger.debug("Signature by kid=%s", kid)
+    else:
+        logger.debug("Signature by unknown key")
+    for key in keys.get_keys(kid) or keys:
         try:
             jws.verify(key=key)
             return key