diff --git a/pycognito/__init__.py b/pycognito/__init__.py index b6a52ef6..025cc85f 100644 --- a/pycognito/__init__.py +++ b/pycognito/__init__.py @@ -277,8 +277,15 @@ def verify_token(self, token, id_name, token_use): # Compute and verify at_hash (formerly done by python-jose) if "at_hash" in verified: alg_obj = jwt.get_algorithm_by_name(header["alg"]) - digest = alg_obj.compute_hash_digest(self.access_token) - at_hash = base64.urlsafe_b64encode(digest[: (len(digest) // 2)]).rstrip("=") + try: + digest = alg_obj.compute_hash_digest(self.access_token) + except TypeError: + digest = alg_obj.compute_hash_digest(self.access_token.encode("utf-8")) + at_hash = base64.urlsafe_b64encode(digest[: (len(digest) // 2)]) + if isinstance(at_hash, bytes): + at_hash = at_hash.rstrip(b"=").decode("utf-8") + else: + at_hash = at_hash.rstrip("=") if at_hash != verified["at_hash"]: raise TokenVerificationException( "at_hash claim does not match access_token."