Azure "JsonWebTokenError: invalid algorithm"

Start with the backend API path containing jwt.verify and compare its Azure Static Web Apps deployment behavior with the local emulator. Inspect the deployed token, certificate returned from the Microsoft identity jwks_uri, and configured RS256 algorithm; the issue is done when the cause of the Azure-only invalid-algorithm error is identified and verification works or the limitation is documented.

Description

Only occurs when deployed to Azure cloud, local Azure Static Web Apps emulator is all ok.

Azure Static Web App (SWA) with integrated API. One of the step at backend API is to validate the Bearer Token with public key submitted in request headers:

const jwt = require("jsonwebtoken");  // v 8.5.1
async function getMSPublicKey(misc)   // misc contains kid and tenantId, confirmed in F12 request header
{
    var vurl = "https://login.microsoftonline.com/" + misc.tenantId + "/v2.0/.well-known/openid-configuration";
    const x1 = await fetch(vurl);
    const x2 = await x1.json();
    const x3 = await fetch(x2.jwks_uri);
    const k = await x3.json();
    return pkey = k.keys.find( k => k.kid === misc.kid).x5c[0];  // public key in the entry matching kid
}

var vmisc = JSON.parse(ac.req.headers["misc"]);
var publickey = "-----BEGIN CERTIFICATE-----\n" + await getMSPublicKey(vmisc) + "\n-----END CERTIFICATE-----";

// next line is reported in AppTraces, Message = JsonWebTokenError: invalid algorithm
var payload = jwt.verify(theToken, publickey, { algorithms: ['RS256'] });
// theToken is validated ok at jwt.io

Environment

Azure Static Web Application

• jsonwebtoken: v 8.5.1
• azurefunctions: 3.5.2.0, node v 14.16.0
• VSC Version: 1.63.1 (system setup)
  Commit: fe719cd3e5825bf14e14182fddeb88ee8daf044f
  Date: 2021-12-14T02:13:54.292Z
  Electron: 13.5.2
  Chromium: 91.0.4472.164
  Node.js: 14.16.0
  V8: 9.1.269.39-electron.0
  OS: Windows_NT x64 10.0.19044