title: Validate JWT (ES256) Token with ---PUBLIC KEY--- in c#
body: <p>I have got a JWT that is created by my AWS ALB using an OpenID Connector. I need to verify the Token in my c# application. But I struggle to get it working.</p>
  
  <p>AWS describes the token validation here: <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html?icmpid=docs_elbv2_console" rel="nofollow noreferrer">https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html?icmpid=docs_elbv2_console</a></p>
  
  <p>It should work in 3 steps:</p>
  
  <ul>
  <li>Get the key id from the token </li>
  <li>Read the public key from the aws alb enpoint <code>(https://public-keys.auth.elb.' + region + '.amazonaws.com/' + key id)</code></li>
  <li>Decrypt the payload using the key</li>
  </ul>
  
  <p>This is the JWT I got: </p>
  
  <blockquote>
    <p>eyJ0eXAiOiJKV1QiLCJraWQiOiJjODE4ZTcxNi01OTAxLTQzOWQtOWFlZC1lYmRmODAyYjZkYTkiLCJhbGciOiJFUzI1NiIsImlzcyI6Imh0dHBzOi8vc2llbWVucy1xYS0wMDA2OS5ldS5hdXRoMC5jb20vIiwiY2xpZW50IjoiMndsS3k0YlRXbGpZWm9KYXZRSVFqVTE3OUprVG4zNDAiLCJzaWduZXIiOiJhcm46YXdzOmVsYXN0aWNsb2FkYmFsYW5jaW5nOmV1LWNlbnRyYWwtMTo0ODU2ODM0ODcxOTY6bG9hZGJhbGFuY2VyL2FwcC9maW5kLXRlc3QtYWxiLzU3YzBmMWYzZjg0YzZjMjEiLCJleHAiOjE1NzU1NDMwMzN9.eyJzdWIiOiJvYXV0aDJ8bWFpbi10ZW5hbnQtb2lkY3xzYW1scHxTaWVtZW5zfFowMDJFSk5VIiwiZ2l2ZW5fbmFtZSI6IlJhcGhhZWwiLCJmYW1pbHlfbmFtZSI6IlNjaG5haXRsIiwibmlja25hbWUiOiJSYXBoYWVsIiwibmFtZSI6IlJhcGhhZWwgU2NobmFpdGwiLCJwaWN0dXJlIjoiaHR0cHM6Ly9zLmdyYXZhdGFyLmNvbS9hdmF0YXIvODkzNWVlY2QzMDc2ZTAyMTQ5ODE2MTZmZjBkZTRkZjI_cz00ODAmcj1wZyZkPWh0dHBzJTNBJTJGJTJGY2RuLmF1dGgwLmNvbSUyRmF2YXRhcnMlMkZyYS5wbmciLCJ1cGRhdGVkX2F0IjoiMjAxOS0xMi0wNVQxMDo0ODozMy4wNjhaIiwiZXhwIjoxNTc1NTQzMDMzLCJpc3MiOiJodHRwczovL3NpZW1lbnMtcWEtMDAwNjkuZXUuYXV0aDAuY29tLyJ9.M39aPefXmaDGzaDd0qHcQHMhvugTVN4i4pyvGJ-7fayewU9vZdtKvSzFF9rVal8GEz7HKTr_auqMw9HemOWyag==</p>
  </blockquote>
  
  <p>The key id therefore is: <code>c818e716-5901-439d-9aed-ebdf802b6da9</code></p>
  
  <p>Public Key:</p>
  
  <pre><code>-----BEGIN PUBLIC KEY-----
  MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENARdEGaEpfgHph3440UodVsQdqxi
  PYz+l1aEcz+Bivr6emXDnor1nET94dbPqYxk+vtUHGkgOb44VPEZUe4ijQ==
  -----END PUBLIC KEY-----
  </code></pre>
  
  <p>I tried to verify the code using the following approaches:</p>
  
  <ul>
  <li>using the <code>System.IdentityModel.Tokens.Jwt</code> Namespace. But I was unable to supply the public key as string to the ValidationParameters. I followed a similar approach of this answer <a href="https://stackoverflow.com/a/51866939/2250672">https://stackoverflow.com/a/51866939/2250672</a>. It felt complicated and error prone. As I could not get it to work after a whole day, I decided to move on to one of the nuget packages that supplies the same functionality.</li>
  <li>using the JWT nuget Package, but it does not support the Algorithm used by AWS ALB.</li>
  <li>using Jose.JWT nuget Package using the following code:</li>
  </ul>
  
  <p><code>Jose.JWT.Decode(__token, publicKeyPem, Jose.JwsAlgorithm.ES256)</code></p>
  
  <p>getting the following error:</p>
  
  <blockquote>
    <p>ERROR: Script execution failed. [ArgumentException] EcdsaUsingSha algorithm expects key to be of either CngKey or ECDsa types.</p>
  </blockquote>
  
  <p>How can I simply verify the JWT from AWS ALB in C# ?</p>