Troubleshooting Tip: Resolving API gateway issue with JWT authentication on FortiWeb

Description

This article describes how to troubleshoot a FortiWeb API Gateway JWT authentication failure where FortiWeb is unable to extract or parse the JWT from the HTTP request.

Scope

FortiWeb.

Solution

The issue may appear with errors similar to the following:

API gateway: cannot get api key

Or:

JWT header parse failed
failed to parse JSON data: unexpected character
API Key verification failed
Action: DENY

• The issue can be triggered when the Verification Mode under the API rule is set to API Key Verification, while the API user is set to JWT.

• The issue can be fixed by disabling the API key verification and switch to JWT public key under the API Gateway Rule:

config waf api-rules 
    edit "JWT Verification" 
        set api-key-verification disable 
        set verification-mode jwt-public-key 
        set jwt-public-key <PEM_encoded_public_key>

• If the issue still persists, consider upgrading to the latest version of FortiWeb, as newer releases include multiple Azure OAuth/JWT enhancements and compatibility improvements.

• The following commands can be used to debug the API Gateway module:

diagnose debug reset
diagnose debug flow filter module-detail api-gateway 7
diagnose debug flow trace start
diagnose debug timestamp enable
diagnose debug enable