Package com.palantir.tokens.auth

Class UnverifiedJsonWebToken

java.lang.Object

com.palantir.tokens.auth.UnverifiedJsonWebToken

@Immutable
public abstract class UnverifiedJsonWebToken
extends java.lang.Object

Represents the parsed form of a JWT but does not verify the token signature.

The information provided by this class should not be used for any security-sensitive application unless verified through some other process (e.g. by querying another service known to perform validation).

An anticipated use of this class is making a best-effort user id extraction for logging.

Constructor Summary

Constructors

Constructor	Description
UnverifiedJsonWebToken()

Method Summary

Modifier and Type	Method	Description
abstract java.util.Optional<java.lang.String>	getUnverifiedSessionId()	Returns the unverified session id for this token, i.e.
abstract java.util.Optional<java.lang.String>	getUnverifiedTokenId()	Returns the unverified token id for this token, i.e.
abstract java.lang.String	getUnverifiedUserId()	Returns the unverified user id, i.e., the "sub" (subject) field of the JWT.
static UnverifiedJsonWebToken	of(BearerToken token)	Attempts to create an UnverifiedJsonWebToken from provided BearerToken.
static java.util.Optional<UnverifiedJsonWebToken>	tryParse(java.lang.String rawAuthHeader)	Does a lower cost check on the structure of string provided before attempting to create an UnverifiedJsonWebToken.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

UnverifiedJsonWebToken

public UnverifiedJsonWebToken()

Method Detail

getUnverifiedUserId

@Parameter
public abstract java.lang.String getUnverifiedUserId()

Returns the unverified user id, i.e., the "sub" (subject) field of the JWT.

getUnverifiedSessionId

@Parameter
public abstract java.util.Optional<java.lang.String> getUnverifiedSessionId()

Returns the unverified session id for this token, i.e. the "sid" field of the JWT or absent if this token does not contain session information.

getUnverifiedTokenId

@Parameter
public abstract java.util.Optional<java.lang.String> getUnverifiedTokenId()

Returns the unverified token id for this token, i.e. the "jti" field of the JWT or absent if this token does not use the "jti" field as a unique identifier.

tryParse

public static java.util.Optional<UnverifiedJsonWebToken> tryParse(java.lang.String rawAuthHeader)

Does a lower cost check on the structure of string provided before attempting to create an UnverifiedJsonWebToken.

of

public static UnverifiedJsonWebToken of(BearerToken token)

Attempts to create an UnverifiedJsonWebToken from provided BearerToken.

The information provided by this class should not be used for any security-sensitive application unless verified through some other process (e.g. by querying another service known to perform validation).

An anticipated use of this class is making a best-effort user id extraction for logging.