集成GCP函数至API网关时遭遇JWT认证无效算法错误

错误根源 #

你的API网关配置中，错误地将Bearer JWT认证定义为apiKey类型，这会导致两种问题：

1. 网关会尝试把JWT当作普通API密钥验证，验证失败后可能篡改或截断Authorization头
2. 即使网关不验证，重复的安全定义也会干扰头信息的正常传递，导致后端收到的JWT不完整或格式异常，最终触发invalid algorithm错误

直接访问GCP函数时，后端能获取完整原始的JWT，所以验证正常；经过网关后，头信息被干扰，验证流程失效。

修复方案 #

方案1：让网关直接传递Authorization头（后端自行处理JWT验证） #

移除网关中所有安全验证配置，让请求头完整传递给后端函数：

swagger: '2.0'
info:
  title: ChatGPT API
  description: API Gateway for ChatGPT Function
  version: 1.0.0
schemes:
  - https
paths:
  /openai:
    post:
      summary: Handle ChatGPT requests
      description: This endpoint handles POST requests for ChatGPT via Google Cloud Function.
      operationId: handleChatGPTRequest
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - in: header
          name: Authorization
          required: true
          type: string
          description: Bearer token for authorization.
      responses:
        '200':
          description: Successful response
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '405':
          description: Method Not Allowed
        '500':
          description: Internal Server Error
      x-google-backend:
        address: https://gcp-function-url/openai
        path_translation: APPEND_PATH_TO_ADDRESS

方案2：配置网关正确处理JWT验证（网关先验证，再转发请求） #

如果需要网关提前验证JWT，需将安全定义改为JWT专属类型，配置发行者、密钥地址等信息：

swagger: '2.0'
info:
  title: ChatGPT API
  description: API Gateway for ChatGPT Function
  version: 1.0.0
schemes:
  - https
securityDefinitions:
  jwt_auth:
    type: "oauth2"
    flow: "implicit"
    authorizationUrl: ""
    x-google-issuer: "你的JWT发行者地址（如自定义issuer或谷歌账号地址）"
    x-google-jwks_uri: "你的JWKS公钥地址（如https://www.googleapis.com/oauth2/v3/certs）"
    x-google-audiences: "你的JWT受众标识（如函数客户端ID）"
paths:
  /openai:
    post:
      summary: Handle ChatGPT requests
      description: This endpoint handles POST requests for ChatGPT via Google Cloud Function.
      operationId: handleChatGPTRequest
      consumes:
        - application/json
      produces:
        - application/json
      security:
        - jwt_auth: []
      responses:
        '200':
          description: Successful response
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '405':
          description: Method Not Allowed
        '500':
          description: Internal Server Error
      x-google-backend:
        address: https://gcp-function-url/openai
        path_translation: APPEND_PATH_TO_ADDRESS

这种模式下，网关会自动验证JWT，验证通过后才转发请求，后端可选择跳过JWT验证，直接使用网关传递的X-Apigateway-Api-Userinfo头获取解析后的用户信息。

额外检查：后端验证代码 #

确保后端JWT验证算法与生成时一致，jsonwebtoken库默认算法为HS256，若生成时使用其他算法（如RS256），需明确指定：

// 后端验证代码示例
const jwt = require('jsonwebtoken');

function authenticateToken(req, res, next) {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];
  
  if (!token) return res.sendStatus(401);

  // 明确指定算法，与生成JWT时一致
  jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] }, (err, decoded) => {
    if (err) return res.sendStatus(403);
    req.user = decoded;
    next();
  });
}

内容的提问来源于stack exchange，提问作者Amir Sohail