修复Flask后端验证Apple登录Swift前端Token的报错问题

针对“Error decoding token. The specified alg value is not allowed”的修复 #

Apple ID Token采用ES256椭圆曲线签名算法，后端解码时必须明确指定该算法，且需使用Apple官方公钥验证签名，不能用本地密钥或错误算法（比如HS256）。

后端Flask代码修正示例 #

import jwt
import requests
import json
from flask import Flask, request, jsonify

app = Flask(__name__)

def get_apple_public_keys():
    # 从Apple官方端点获取实时公钥
    response = requests.get("https://appleid.apple.com/auth/keys")
    return response.json()["keys"]

def decode_apple_id_token(id_token):
    keys = get_apple_public_keys()
    for key in keys:
        try:
            public_key = jwt.algorithms.RSAAlgorithm.from_jwk(json.dumps(key))
            # 必须指定algorithms=["ES256"]，同时验证audience和issuer
            return jwt.decode(
                id_token,
                public_key,
                algorithms=["ES256"],
                audience="你的iOS应用Bundle ID",  # 替换为实际Bundle ID
                issuer="https://appleid.apple.com"
            )
        except jwt.InvalidTokenError:
            continue
    raise ValueError("Invalid Apple ID Token")

@app.route('/auth/apple', methods=['POST'])
def apple_auth():
    # 后续用户逻辑处理

针对“Authorization token is missing in the request header”的修复 #

前端需将Apple返回的identityToken转换为字符串，以Bearer {token}的格式放入请求头的Authorization字段中，确保拼写和格式正确。

前端Swift代码修正示例 #

import AuthenticationServices

class AppleLoginHandler: NSObject, ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {
    func startAppleLogin() {
        let appleIDProvider = ASAuthorizationAppleIDProvider()
        let request = appleIDProvider.createRequest()
        request.requestedScopes = [.fullName, .email]
        
        let authorizationController = ASAuthorizationController(authorizationRequests: [request])
        authorizationController.delegate = self
        authorizationController.presentationContextProvider = self
        authorizationController.performRequests()
    }
    
    func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
        guard let appleIDCredential = authorization.credential as? ASAuthorizationAppleIDCredential else { return }
        guard let identityToken = appleIDCredential.identityToken else {
            print("Identity token为空")
            return
        }
        guard let idTokenString = String(data: identityToken, encoding: .utf8) else {
            print("Token转字符串失败")
            return
        }
        
        // 构造请求并设置Authorization头
        guard let url = URL(string: "你的后端认证接口地址") else { return }
        var request = URLRequest(url: url)
        request.httpMethod = "POST"
        // 关键：格式为Bearer + 空格 + token
        request.setValue("Bearer \(idTokenString)", forHTTPHeaderField: "Authorization")
        
        let task = URLSession.shared.dataTask(with: request) { data, response, error in
            // 处理后端响应
            if let error = error {
                print("请求错误：\(error)")
                return
            }
            // 解析响应数据...
        }
        task.resume()
    }
    
    func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
        return UIApplication.shared.windows.first!
    }
}

额外检查点 #

1. 后端接口确保正确获取请求头：使用request.headers.get('Authorization')，不要误用request.form或其他方式提取token
2. 确认iOS应用的Bundle ID与后端audience参数完全一致
3. 检查后端是否存在中间件过滤了Authorization请求头

内容的提问来源于stack exchange，提问作者Michiel Voortman