Programmatic verification for Node.js example does not work with jose 6

[zdunecki]

Example URL(s)

• https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/#javascript-nodejs-example

Actual Behavior

For jose 6 error like Received an instance of CryptoKey. I've checked with jose 5 - everything works fine.

Expected Behavior

With jose 6 verification should pass without any errors.

Additional information

No response

[ranbel]

@bondz Would you happen to know anything about this issue since you added the original jose example? #17824

[bondz]

I've tested with jose v6.0.0 and the latest version of jose on node24 and node22 and node20 but I don't see this error, nor do I see it in a prod deployment I have that's been running for a while now on jose v6.0.12.

I tried to reproduce the error with the code below, adapted from the docs.

Save this as jose-test.cjs and run node jose-test.cjs

const jose = require('jose');

// The Application Audience (AUD) tag for your application
const AUD = '<replacethis>'

// Your CF Access team domain
const TEAM_DOMAIN = 'https://<replacethis>.cloudflareaccess.com';
const CERTS_URL = `${TEAM_DOMAIN}/cdn-cgi/access/certs`;

const JWKS = jose.createRemoteJWKSet(new URL(CERTS_URL));

const verifyToken = async (data) => {
  // Check for the AUD environment variable
  if (!AUD) {
    console.error('AUD is not set');
    return false;
  }

  const token = data.token;

  if (!token) {
    console.error('Token is not set');
    return false;
  }

  try {
    const result = await jose.jwtVerify(token, JWKS, {
      issuer: TEAM_DOMAIN,
      audience: AUD,
    });

    return result.payload;
  } catch (err) {
    console.error('Invalid token', err);
    return false;
  }
};


const result = verifyToken({ token: 'example.jwt.token' }).then(console.log);

One possibility is that it might be an issue with esm but maybe you could try sharing an example to reproduce your error.