Package com.nimbusds.jwt.proc

Class DefaultJWTProcessor<C extends SecurityContext>

  • All Implemented Interfaces:
    JOSEProcessorConfiguration<C>, ConfigurableJWTProcessor<C>, JWTProcessor<C>, JWTProcessorConfiguration<C>
    public class DefaultJWTProcessor<C extends SecurityContext>
extends Object
implements ConfigurableJWTProcessor<C>
    Default processor of unsecured (plain), signed and encrypted JSON Web Tokens (JWTs).

    Must be configured with the following:

    • To process signed JWTs: A JWS key selector using the header or the header and claims set to suggest key candidate(s) for the signature verification. The key selection procedure is application-specific and may involve key ID lookup, a certificate check and / or some context.
    • To process encrypted JWTs: A JWE key selector using the header to suggest key candidate(s) for decryption. The key selection procedure is application-specific and may involve key ID lookup, a certificate check and / or some context.

    An optional context parameter is available to facilitate passing of additional data between the caller and the underlying selector of key candidates (in both directions).

    See sections 6 of RFC 7515 (JWS) and RFC 7516 (JWE) for guidelines on key selection.

    This processor is configured with a standard header "typ" (type) parameter verifier which expects the signed, encrypted and plain (unsecured) JWTs to have the type header omitted or set to JWT. To accept other "typ" values pass an appropriately configured JWS and / or JWE type verifier.

    This processor comes with the default JWS verifier factory and the default JWE decrypter factory; they can construct verifiers / decrypters for all standard JOSE algorithms implemented by the library.

    Note that for security reasons this processor is hardwired to reject unsecured (plain) JWTs. Override the process(PlainJWT, SecurityContext) if you need to handle plain JWTs.

    A default JWT claims verifier is provided, to perform a minimal check of the claims after a successful JWS verification / JWE decryption. It checks the token expiration (exp) and not-before (nbf) timestamps if these are present. The default JWT claims verifier may be extended to perform additional checks, such as issuer and subject acceptance.

    To process generic JOSE objects (with arbitrary payloads) use the DefaultJOSEProcessor class.

    Version:
    2021-06-05
    Author:
    Vladimir Dzhuvinov