slashes not supported at jwt location key

[bbetters]

Component

What is the current behaviour?

I need to share the same token from hasura v2 that has this key https://hasura.io/jwt/claims but it wont work and i tryied to find out why.
at auth-config.html im providing the following:
jwt:
claimsConfig:
namespace:
claimsFormat: Json
location: /claims.jwt.hasura.io and it works unless i add another / like /claims.jwt.hasura.io/test
https://hasura.io/jwt/claims doesnt work as well for the same reason i suspect

What is the expected behaviour?

{
"errors": [
{
"status": 500,
"message": "The GraphQL URL responded with a non-200 status code.",
"details": {
"data": null,
"errors": [
{
"message": "Internal Error - Hasura claims not found in the JWT at /claims.jwt.hasura.io/test"
}
]
}
}
]
}

How to reproduce the issue?

1. set the namespace location at auth-config.html to contain a slash like this /claims.jwt.hasura.io/test
2. Generate a token with this key and use it in the console

Any possible solutions/workarounds you're aware of?

Workaround is to change the key in hasura v2 if possible but it may break my existing project

[robertjdominguez]

Hey, thanks for surfacing this — great question, @bbetters 👇

You’re right that adding an extra / to the namespace.location path causes issues, but the root of the problem is how Hasura DDN interprets that path. It follows the JSON Pointer spec (RFC 6901), which means each / in the path represents a new level of nesting in the JWT payload.

So when you write:

namespace:
  location: /claims.jwt.hasura.io/test

Hasura’s expecting something like this in your token:

{
  "claims": {
    "jwt": {
      "hasura": {
        "io": {
          "test": {
            "x-hasura-role": "user"
          }
        }
      }
    }
  }
}

Which obviously doesn't line up with a flat key like https://hasura.io/jwt/claims.

If you're reusing your v2 tokens and the claim is under that flat key, then what you actually need is to escape each / in the key using ~1, as required by the JSON Pointer spec. So your config should look like this:

claimsConfig:
  namespace:
    location: "/https:~1~1hasura.io~1jwt~1claims"

That tells Hasura to treat the full string https://hasura.io/jwt/claims as a single key, not a nested object path.

I haven't tested this myself, but from reading the spec and the fact that we reference it in the configuration docs, this should unblock you.