WellData Implementation Guide - Local Development build (v0.1.0) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions

HTI - Receiving a launch

Verifying the signature.

The public keys should be retrieved by the following procedure:

• Fetch the <iss>/.well-known/openid-configuration as JSON
• Look for the jwks_uri value
• Fetch the JWKS object from the jwks_uri
• Decode and parse the header of the JWT and extract the kid header.
• Locate the right public key in the JWKS object.
• Use the matching public key to verify the JWT.

Example code:

const iss = atob(jwt.split('.')[0])
const open_id_config = await fetch(`${iss}/..well-known/openid-configuration`).then(data => data.json())
const own_url = 'https//module.example.com'
const issuer = open_id_config['issuer']
const jwks_uri = open_id_config['jwks_uri']
const JWKS = jose.createRemoteJWKSet(new URL(jwks_uri))

const {payload, protectedHeader} = await jose.jwtVerify(jwt, JWKS, {
  issuer: ussuer,
  audience: own_url,
})

Other important checks

In addition to verifying the signature, the JWT payload contains fields that are important to validate.