Skip to main content
J
johnn80483458
January 14, 2026
Answered

Decode JSON Web Token in CF2025.

  • January 14, 2026
  • 1 reply
  • 132 views

I'm working on building an interface with ID.me.  I am currently getting back a valid JWT from the ID.me API (it successfully decodes using JWT.IO) but I'm having trouble decoding it in ColdFusion.  The CF function VerifySignedJWT has three required parameters and, I believe, I am having trouble with the second parameter signOptions.  The CF documentation indicates this parameter should be a strcut containing the key, KeyPair, JWK-JSON Web Keyset URL or file or string, Keystore file, keystore password, keystore alias.

I am retrieveing the key array from the JWK-JSON Web Keyset URL (ID.me's well known endpoint) but am stuck here.  When I attempt to decode using
        <cftry>
            <cfset payload = VerifySignedJWT(idToken, key, c)>
            <cfcatch type="any">
                <cfdump var = '#cfcatch#'>
                <cfabort>
            </cfcatch>
        </cftry>
where ‘key’ is the RS256 key struct from the key array returned from the well-known endpoint.

I am getting the exception

 

struct

Detail

Either the keystore path is invalid or corrupt or the keystore password is wrong.

Message

Error in loading keystore.

StackTrace

coldfusion.util.KeystoreUtils$InvalidKeystoreException: Error in loading keystore. at coldfusion.util.KeystoreUtils.getKeyPair(KeystoreUtils.java:93) at coldfusion.jwt.StandardJwtProvider.verifySignedJwt(StandardJwtProvider.java:148) at coldfusion.runtime.CFPage.VerifySignedJWT(CFPage.java:18615) at cfidme2ecfc1636214689$funcDECODEIDTOKEN.runFunction(……

 

I have tried using the well-known enpoint URL, the full struct of keys (httpResult) returned from the well-known endpoint, just the RS256 key struct contained withing the httpResult array of keys.  I keep getting the same error.

I can decode the token returned from the API at JWT.IO and I can validate the token, using the key returned from the well-known endpoint, at JWT.IO.

 

What am I missing?
Thanks!

 

    Correct answer johnn80483458

    @BKBK thank you so much for your responses.  They helped me to rethink the approach I have been taking.  The built-in JWT functions are not the solution in this case.  As I mentioned in my original post, the JWT I am getting from ID.me can be decoded using an online tool such as JWT.IO so everything needed is contained in the JWT.  The JWT consists of three Base64URL enconded strings delimited by periods (.)  The solution is to separate the JWT into its three component parts (listToArray) and thn use CF's binaryDecode to get the component part back into binary data and then convert the binary data into a string.  Doing this on the second component element in the ID.me token get's the 'Payload' of the token.  Hope this helps someone else in the future.

    1 reply

    BKBK
    Community Expert
    BKBKCommunity Expert
    Community Expert
    January 15, 2026

    I don't think you are missing anything. My guess is that VerifySignedJWT() in ColdFusion 2025 does not support remote JWKS URLs. So, when you retrieve the key from the JWK-JSON Web Keyset URL   

    https://api.idmelabs.com/oidc/.well-known/jwks

    ColdFusion treats that as a keystore reference, not as a JWKS endpoint. As a result, ColdFusion tries to load it as a Java keystore file. That would explain why you get: "Either the keystore path is invalid or corrupt or the keystore password is wrong".

     

    BKBK
    Community Expert
    BKBKCommunity Expert
    Community Expert
    January 16, 2026

    Looking into the issue some more, my initial thoughts have been confirmed. You get "Error in loading keystore" because the way the keys are exposed in ID.me is different from the way ColdFusion handles them.

     

    ID.me uses OIDC / OAuth2, which means:

    • Tokens are signed with rotating public keys;
    • Public keys are exposed via JWKS (JSON Web Key Set) over HTTPS.

    Whereas, ColdFusion’s built-in JWT functions (VerifySignedJWT, SignJWT) were designed for:

    • Static keystores (JKS / PKCS12);
    • Local key material on the ColdFusion server;
    • Enterprise/internal JWT use.
    J
    johnn80483458AuthorCorrect answer
    January 26, 2026

    @BKBK thank you so much for your responses.  They helped me to rethink the approach I have been taking.  The built-in JWT functions are not the solution in this case.  As I mentioned in my original post, the JWT I am getting from ID.me can be decoded using an online tool such as JWT.IO so everything needed is contained in the JWT.  The JWT consists of three Base64URL enconded strings delimited by periods (.)  The solution is to separate the JWT into its three component parts (listToArray) and thn use CF's binaryDecode to get the component part back into binary data and then convert the binary data into a string.  Doing this on the second component element in the ID.me token get's the 'Payload' of the token.  Hope this helps someone else in the future.

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices