envoyproxy/envoy

JWT claim extraction without signature validation?

Open

#39,930 opened on Jun 17, 2025

View on GitHub
 (13 comments) (0 reactions) (1 assignee)C++ (5,373 forks)batch import
area/jwt_authnenhancementhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Hi, I'm working on a rate limiting use case where I need to extract claims from JWTs and pass them as headers to upstream services, but I don't need (or want) signature validation.

My situation:

  • Need to extract claims like username, plan_name, etc. and forward as HTTP headers
  • Upstream service does not support JWKS at this time
  • Currently using a Lua filter to parse JWT manually, but would prefer using the built-in JWT filter

Question: Is there any way to configure the envoy.filters.http.jwt_authn filter to extract JWT claims to headers WITHOUT validating the signature?

I've tried setting up the JWT filter with empty JWKS and allow_missing_or_failed, but I get "Jwt header [alg] is not supported" errors.

Thanks!

Contributor guide

Research direction
Investigate the JWT filter code to see if there is a way to bypass signature validation and extract claims to headers. Consider adding a new configuration option like `skip validation` that allows extracting claims without verifying signature.
Tech stack
None
Domain
backendauthentication
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitC++Envoy development environment
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60