From 56bfd34387904e77c5cdd78d13bcbad1181ad428 Mon Sep 17 00:00:00 2001
From: mohammed arib <arib@bugqore.com>
Date: Fri, 9 Oct 2026 14:03:18 +0530
Subject: [PATCH] fix: skip unsupported keys when loading JWK set in
 IdTokenVerifier

---
 .../auth/openidconnect/IdTokenVerifier.java   |  5 ++++-
 .../openidconnect/IdTokenVerifierTest.java    | 20 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdTokenVerifier.java b/google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdTokenVerifier.java
index 979bfeb0e..703097d1d 100644
--- a/google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdTokenVerifier.java
+++ b/google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdTokenVerifier.java
@@ -625,7 +625,10 @@ public Map<String, PublicKey> load(String certificateUrl) throws Exception {
       } else {
         for (JsonWebKey key : jwks.keys) {
           try {
-            keyCacheBuilder.put(key.kid, buildPublicKey(key));
+            PublicKey publicKey = buildPublicKey(key);
+            if (publicKey != null && key.kid != null) {
+              keyCacheBuilder.put(key.kid, publicKey);
+            }
           } catch (NoSuchAlgorithmException
               | InvalidKeySpecException
               | InvalidParameterSpecException ignored) {
diff --git a/google-oauth-client/src/test/java/com/google/api/client/auth/openidconnect/IdTokenVerifierTest.java b/google-oauth-client/src/test/java/com/google/api/client/auth/openidconnect/IdTokenVerifierTest.java
index 556797eeb..24e609f5a 100644
--- a/google-oauth-client/src/test/java/com/google/api/client/auth/openidconnect/IdTokenVerifierTest.java
+++ b/google-oauth-client/src/test/java/com/google/api/client/auth/openidconnect/IdTokenVerifierTest.java
@@ -305,6 +305,26 @@ public void testVerifyRs256Token() throws IOException {
     assertTrue(tokenVerifier.verify(IdToken.parse(JSON_FACTORY, FEDERATED_SIGNON_RS256_TOKEN)));
   }
 
+  public void testVerifyRs256TokenSkipsUnsupportedKeyInKeySet() throws IOException {
+    // A JWK Set may legitimately contain a key this client cannot build a PublicKey from, e.g. a
+    // key whose algorithm is not RS256/ES256. That key must be skipped so the remaining valid keys
+    // are still usable, instead of aborting the whole key set.
+    String unsupportedKey =
+        "{\"kid\":\"unsupported\",\"kty\":\"oct\",\"alg\":\"HS256\",\"k\":\"c2VjcmV0\"},";
+    String keysWithUnsupportedKey =
+        readResourceAsString("federated_keys.json")
+            .replace("\"keys\": [", "\"keys\": [" + unsupportedKey);
+    HttpTransportFactory httpTransportFactory =
+        mockTransport("https://www.googleapis.com/oauth2/v3/certs", keysWithUnsupportedKey);
+    MockClock clock = new MockClock(1587625988000L);
+    IdTokenVerifier tokenVerifier =
+        new IdTokenVerifier.Builder()
+            .setClock(clock)
+            .setHttpTransportFactory(httpTransportFactory)
+            .build();
+    assertTrue(tokenVerifier.verify(IdToken.parse(JSON_FACTORY, FEDERATED_SIGNON_RS256_TOKEN)));
+  }
+
   public void testVerifyRs256TokenWithLegacyCertificateUrlFormat()
       throws IOException, VerificationException {
     HttpTransportFactory httpTransportFactory =