{"action":"opened","issue":{"url":"https://api.github.com/repos/cloudfoundry/uaa/issues/282","labels_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/282/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/282/comments","events_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/282/events","html_url":"https://github.com/cloudfoundry/uaa/issues/282","id":124255473,"number":282,"title":"/token_key possibly returns the wrong value for `alg`","user":{"login":"jasonkeene","id":161453,"avatar_url":"https://avatars.githubusercontent.com/u/161453?v=3","gravatar_id":"","url":"https://api.github.com/users/jasonkeene","html_url":"https://github.com/jasonkeene","followers_url":"https://api.github.com/users/jasonkeene/followers","following_url":"https://api.github.com/users/jasonkeene/following{/other_user}","gists_url":"https://api.github.com/users/jasonkeene/gists{/gist_id}","starred_url":"https://api.github.com/users/jasonkeene/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jasonkeene/subscriptions","organizations_url":"https://api.github.com/users/jasonkeene/orgs","repos_url":"https://api.github.com/users/jasonkeene/repos","events_url":"https://api.github.com/users/jasonkeene/events{/privacy}","received_events_url":"https://api.github.com/users/jasonkeene/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-29T19:14:58Z","updated_at":"2015-12-29T19:14:58Z","closed_at":null,"body":"I was a bit confused as to why the JWK that is returned by `/token_key` has `alg` set to `SHA256withRSA`:\r\n\r\n```\r\ncurl https://uaa.run.pivotal.io/token_key -s | jq .\r\n{\r\n  \"alg\": \"SHA256withRSA\",\r\n  \"value\": \"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8/aXmEImpdwWHJlYc4G8\\n3BgZVmyhCdy7SCL0kM7wV5xCvRKK0k4nKjH0QW2E+0GIKzIj4JQhYU+MeZHrArfC\\nrfthIXcio/Ll6NvoTPY77XA7U6vBGCiLdGYSGrN8y064cF2uM8d3AEgTT0RzLK3E\\n688Ltq38GxnoXOUuLZmXS2HeHNd2bW/k6Eyd9Z3ymmdpVZXMyLwepNxU38WQS2bJ\\nPYXYvRkzoZ1ru/deExwbecI18NCeO/GKp3f8bwKuC2j3LKFJIAwW3zFoDrcAxpC/\\nJDG2RSTj//CRvhtd7JkeQLVKGyIHNtACaPT3tFT6scvVXHGPB5fRTLB8Lr+mK4RI\\nBwIDAQAB\\n-----END PUBLIC KEY-----\\n\",\r\n  \"kty\": \"RSA\",\r\n  \"use\": \"sig\",\r\n  \"n\": \"APP2l5hCJqXcFhyZWHOBvNwYGVZsoQncu0gi9JDO8FecQr0SitJOJyox9EFthPtBiCsyI+CUIWFPjHmR6wK3wq37YSF3IqPy5ejb6Ez2O+1wO1OrwRgoi3RmEhqzfMtOuHBdrjPHdwBIE09EcyytxOvPC7at/BsZ6FzlLi2Zl0th3hzXdm1v5OhMnfWd8ppnaVWVzMi8HqTcVN/FkEtmyT2F2L0ZM6Gda7v3XhMcG3nCNfDQnjvxiqd3/G8Crgto9yyhSSAMFt8xaA63AMaQvyQxtkUk4//wkb4bXeyZHkC1ShsiBzbQAmj097RU+rHL1VxxjweX0UywfC6/piuESAc=\",\r\n  \"e\": \"AQAB\"\r\n}\r\n```\r\n\r\nI did not find this string in any of the RFCs I looked at. I found it in the spring framework oauth code and that's about it. RFC7517 has an example JWK in the appendix that uses the same string (`RS256`) that is used in the JWT `alg` header.\r\n\r\nhttps://tools.ietf.org/html/rfc7517#appendix-A.1\r\n\r\n```\r\n{\"kty\":\"RSA\",\r\n          \"n\": \"0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx\r\n     4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMs\r\n     tn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2\r\n     QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbI\r\n     SD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqb\r\n     w0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw\",\r\n          \"e\":\"AQAB\",\r\n          \"alg\":\"RS256\",\r\n          \"kid\":\"2011-04-29\"}\r\n```\r\n\r\nThis makes more sense to me. Is this a bug?"}}