title: Auth0 java-jwt library fails to verify a valid token
body: <p>I'm using the Auth0 <code>java-jwt</code> library to generate JWT tokens, however, once generated I'm not able to verify the tokens. </p>
  
  <p>This is the code I use to generate the token:</p>
  
  <pre><code>final JWTSigner signer = new JWTSigner(secret);
  final HashMap&lt;String, Object&gt; claims = new HashMap&lt;String, Object&gt;();
  claims.put("user", user);
  claims.put("email", user.getEmail());
  final String jwt = signer.sign(claims);
  return jwt;
  </code></pre>
  
  <p>This is my secret and the token (it verifies correctly in <a href="https://jwt.io/" rel="nofollow noreferrer">https://jwt.io/</a>):</p>
  
  <blockquote>
    <p><strong>secret</strong>:<br>
    sfnd984f94j3fjn</p>
    
    <p><strong>token</strong>: eyJ0eXBlIjoiSldUIiwiYWxnIjoiSFMyNTYifQ.eyJ1c2VyIjp7ImlkIjoyLCJlbWFpbCI6InNhbnRob3NoQHh5ei5jb20iLCJwYXNzd29yZCI6IiQyYSQxMCRHSlNNRGtRRUEvRVNsRENJcVlud0R1Ly45YWRqRWRQalVvSWVKUmlsSmpSeHh6N2s2Q01xQyIsImZpcnN0X25hbWUiOiJzYW50aG9zaCIsImxhc3RfbmFtZSI6Imt1bWFyIiwic3RhdHVzIjoxLCJ0aXRsZSI6IkFzc29jIiwicm9sZXMiOlt7ImlkIjoxLCJyb2xlIjoiVVNFUiJ9XX0sImVtYWlsIjoic2FudGhvc2hAeHl6LmNvbSJ9.0SHNCgUWOijpYv7xcNoPiCwg_OFZQnsdi5l7YhCsSjU</p>
  </blockquote>
  
  <p>When I use the same JWT token to verify it using the Auth0 method it fails (always ends up with a signature exception): </p>
  
  <pre><code>try {           
      final JWTVerifier verifier = new JWTVerifier(secret);
      final Map&lt;String, Object&gt; claims= verifier.verify(jwt);
      final String email = (String)claims.get("email");
      user =  userService.loadUserByEmail(email);
  } catch (UsernameNotFoundException e) {
      // Invalid Token
  } catch (SignatureException e) {
      System.out.println(e.toString());
  } catch (IOException e) { 
  } catch (Exception e) { 
  }
  </code></pre>
  
  <p>I debugged the library and I think this is where the issue is (in <code>JWTVerifier</code> class): </p>
  
  <pre><code>void verifySignature(String[] pieces, String algorithm) 
      throws NoSuchAlgorithmException, InvalidKeyException, SignatureException {
  
      Mac hmac = Mac.getInstance(algorithm);
      hmac.init(new SecretKeySpec(decoder.decodeBase64(secret), algorithm));
      byte[] sig = hmac.doFinal(
          new StringBuilder(pieces[0]).append(".").append(pieces[1]).toString().getBytes());
  
      if (!Arrays.equals(sig, decoder.decodeBase64(pieces[2]))) {
          throw new SignatureException("signature verification failed");
      }
  }
  </code></pre>
  
  <p>This looks wrong to me because the <code>pieces[1]</code> and <code>pieces[0]</code> are decoded with the <code>hmac.doFinal</code> where as the <code>pieces[2]</code> is just plain base64 decoded. </p>
  
  <p>Is my assumption right. Is this a bug in the library or am I getting something wrong?</p>