# JWT signature is ignored

**URL:** <https://discuss.konghq.com/t/jwt-signature-is-ignored/3587>\
**Category:** Questions\
**Tags:** kubernetes\
**Created:** [May 22, 2019, 6:33am UTC](https://discuss.konghq.com/t/jwt-signature-is-ignored/3587 "2019-05-22T06:33:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![niklasye](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/niklasye/32/857_2.png) [@niklasye](https://discuss.konghq.com/u/niklasye)\
**Post date:** [May 22, 2019, 6:33am UTC](https://discuss.konghq.com/t/jwt-signature-is-ignored/3587/1 "2019-05-22T06:33:52Z")

</div>

I’m attempting to setup JWT authentication in kong/ingress-controller.

So far it seems to recognize the token and checks expiration and such just as expected, and it also returns unauthorized if not token is passed.

The problem is that it doesn’t seem to validate the integrity of the token, I can mess with the signature or other parts of the token and it’s still accepted. I expected that the signature would always be checked.

I must have missed something, I’ll post the resources I’ve deployed below:

JWT plugin:  
apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1)  
kind: KongPlugin  
metadata:  
clusterName: “”  
labels:  
[app.kubernetes.io/instance:](http://app.kubernetes.io/instance:) kong  
[app.kubernetes.io/managed-by:](http://app.kubernetes.io/managed-by:) Tiller  
[app.kubernetes.io/name:](http://app.kubernetes.io/name:) kong  
global: “false”  
helm.sh/chart: kong-2.1.2  
name: kong-jwt  
namespace: acc3-iot-kong  
plugin: jwt

kong consumer:  
apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1)  
kind: KongConsumer  
metadata:  
clusterName: “”  
labels:  
[app.kubernetes.io/instance:](http://app.kubernetes.io/instance:) kong  
[app.kubernetes.io/managed-by:](http://app.kubernetes.io/managed-by:) Tiller  
[app.kubernetes.io/name:](http://app.kubernetes.io/name:) kong  
helm.sh/chart: kong-2.1.2  
name: kong  
namespace: acc3-iot-kong  
username: kong

kong credential:  
apiVersion: [configuration.konghq.com/v1](http://configuration.konghq.com/v1)  
config:  
algorithm: RS256  
key: [http://localhost:8080/auth/realms/iot](http://localhost:8080/auth/realms/iot)  
rsa\_public\_key: |-  
-----BEGIN PUBLIC KEY-----  
  
-----END PUBLIC KEY-----  
consumerRef: kong  
kind: KongCredential  
metadata:  
clusterName: “”  
labels:  
[app.kubernetes.io/instance:](http://app.kubernetes.io/instance:) kong  
[app.kubernetes.io/managed-by:](http://app.kubernetes.io/managed-by:) Tiller  
[app.kubernetes.io/name:](http://app.kubernetes.io/name:) kong  
helm.sh/chart: kong-2.1.2  
name: kong  
namespace: acc3-iot-kong  
type: jwt

Is there something I’ve missed, like an option to turn on signature validation or something?

Also the kong version is 1.1.2, and ingress-controller 0.4.0. I’m running db-less in kubernetes/openshift

---

<div class="post-metadata">

**Author:** ![niklasye](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/niklasye/32/857_2.png) [@niklasye](https://discuss.konghq.com/u/niklasye)\
**Post date:** [May 22, 2019, 7:15am UTC](https://discuss.konghq.com/t/jwt-signature-is-ignored/3587/2 "2019-05-22T07:15:46Z")

</div>

I think I found the problem.

It seems that the jwt plugin needs to be defined in the same namespace as the ingress rule.