Getting different JWT tokens with the same key - cakephp

Question

I am new to the JWT tokens, and I am trying get information from a jwt token. The thing is I don't have issues when I am the one generating the token, but, for some reason, when I generate the token at JWT.io with exactly the same information, the token is different and, therefore, the validation fails. I guess the problem may come from the key I am using, as, when using a simple key like "HELLO", this disparity does not happen. This is my code:
<?php
namespace App\Controller\Component;
use Cake\Controller\Component;
use \Firebase\JWT\JWT;
use Cake\ORM\TableRegistry;
class JWTComponent extends Component
{
public function check_token($token){
$decoded = [];
$key = openssl_pkey_get_details(openssl_pkey_get_private('file://'.APP.'private.pem'))['key'];
try {
$decoded = JWT::decode($token, $key, array('HS256'));
$decoded = (array) $decoded;
} catch (Exception $e) {
$decoded = ['error' => $e->getMessage()];
}finally{
return $decoded;
}
}
public function get_token($data) {
$key = openssl_pkey_get_details(openssl_pkey_get_private('file://'.APP.'private.pem'))['key'];
return JWT::encode($data, $key);
}
}

Answer 1

Your intuition is good. The integrity of the token is verified by checking the signature. Tokens are signed by the party which issued them. You can use different algorithms to sign those tokens. As #jps pointed out you can have symmetric and asymmetric signing. In symmetric signing the same key is used to sign and verify the key. HS256 is a symmetric signing algorithm. You can use a certificate to do that (like in your code), but it's a bit of an overkill in my opinion. Anyway, if you want the key generated at JWT.io to be valid in your code, you will have to paste the private key in JWT.io so that it can be used for signing. Then the token should be valid in your code. That's why it worked when you used a simple string as the key.
The token that you generate in your code and in JWT.io can, in the end, look a bit differently. That is, they will both be long strings, with three parts separated by dots, but the strings does not have to be equal. This does not mean that this is a different token. The encoded JWT can differ depending on whether you used line breaks in the input, or how many spaces you used. Even though, the encoded final JWTs may look differently, these tokens have still the same value. If you decode them, you will get the same JSON, maybe slightly differently formatted.
As for the use of the symmetric algorithm, it's usually better to use asymmetric signing, so if you are able to go with that option I would definitely recommend it. Also, have a look at some libraries for PHP to issue and validate JWT, unless you write the code to learn more about JWT itself. You can find a list of libraries on JWT.io.
If you're planning to secure your APIs with JWTs, have a look at this security best practices article I wrote, to learn about the dos and don'ts of JWTs.