SEPARATOR_CHAR| Constructor and Description |
|---|
DefaultJwtParser() |
| Modifier and Type | Method and Description |
|---|---|
protected JwtSignatureValidator |
createSignatureValidator(SignatureAlgorithm alg,
Key key) |
boolean |
isSigned(String jwt)
Returns
true if the specified JWT compact string represents a signed JWT (aka a 'JWS'), false
otherwise. |
Jwt |
parse(String jwt)
Parses the specified compact serialized JWT string based on the builder's current configuration state and
returns the resulting JWT or JWS instance.
|
<T> T |
parse(String compact,
JwtHandler<T> handler)
Parses the specified compact serialized JWT string based on the builder's current configuration state and
invokes the specified
handler with the resulting JWT or JWS instance. |
Jws<Claims> |
parseClaimsJws(String claimsJws)
Parses the specified compact serialized JWS string based on the builder's current configuration state and
returns
the resulting Claims JWS instance.
|
Jwt<Header,Claims> |
parseClaimsJwt(String claimsJwt)
Parses the specified compact serialized JWT string based on the builder's current configuration state and
returns
the resulting unsigned plaintext JWT instance.
|
Jws<String> |
parsePlaintextJws(String plaintextJws)
Parses the specified compact serialized JWS string based on the builder's current configuration state and
returns
the resulting plaintext JWS instance.
|
Jwt<Header,String> |
parsePlaintextJwt(String plaintextJwt)
Parses the specified compact serialized JWT string based on the builder's current configuration state and
returns
the resulting unsigned plaintext JWT instance.
|
protected Map<String,Object> |
readValue(String val) |
JwtParser |
require(String claimName,
Object value)
Ensures that the specified
claimName exists in the parsed JWT. |
JwtParser |
requireAudience(String audience)
Ensures that the specified
aud exists in the parsed JWT. |
JwtParser |
requireExpiration(Date expiration)
Ensures that the specified
exp exists in the parsed JWT. |
JwtParser |
requireId(String id)
Ensures that the specified
jti exists in the parsed JWT. |
JwtParser |
requireIssuedAt(Date issuedAt)
Ensures that the specified
iat exists in the parsed JWT. |
JwtParser |
requireIssuer(String issuer)
Ensures that the specified
iss exists in the parsed JWT. |
JwtParser |
requireNotBefore(Date notBefore)
Ensures that the specified
nbf exists in the parsed JWT. |
JwtParser |
requireSubject(String subject)
Ensures that the specified
sub exists in the parsed JWT. |
JwtParser |
setAllowedClockSkewSeconds(long seconds)
Sets the amount of clock skew in seconds to tolerate when verifying the local time against the
exp
and nbf claims. |
JwtParser |
setClock(Clock clock)
Sets the
Clock that determines the timestamp to use when validating the parsed JWT. |
JwtParser |
setCompressionCodecResolver(CompressionCodecResolver compressionCodecResolver)
Sets the
CompressionCodecResolver used to acquire the CompressionCodec that should be used to
decompress the JWT body. |
JwtParser |
setSigningKey(byte[] key)
Sets the signing key used to verify any discovered JWS digital signature.
|
JwtParser |
setSigningKey(Key key)
Sets the signing key used to verify any discovered JWS digital signature.
|
JwtParser |
setSigningKey(String base64EncodedKeyBytes)
Sets the signing key used to verify any discovered JWS digital signature.
|
JwtParser |
setSigningKeyResolver(SigningKeyResolver signingKeyResolver)
Sets the
SigningKeyResolver used to acquire the signing key that should be used to verify
a JWS's signature. |
public JwtParser requireIssuedAt(Date issuedAt)
JwtParseriat exists in the parsed JWT. If missing or if the parsed
value does not equal the specified value, an exception will be thrown indicating that the
JWT is invalid and may not be used.requireIssuedAt in interface JwtParserMissingClaimException,
IncorrectClaimExceptionpublic JwtParser requireIssuer(String issuer)
JwtParseriss exists in the parsed JWT. If missing or if the parsed
value does not equal the specified value, an exception will be thrown indicating that the
JWT is invalid and may not be used.requireIssuer in interface JwtParserMissingClaimException,
IncorrectClaimExceptionpublic JwtParser requireAudience(String audience)
JwtParseraud exists in the parsed JWT. If missing or if the parsed
value does not equal the specified value, an exception will be thrown indicating that the
JWT is invalid and may not be used.requireAudience in interface JwtParserMissingClaimException,
IncorrectClaimExceptionpublic JwtParser requireSubject(String subject)
JwtParsersub exists in the parsed JWT. If missing or if the parsed
value does not equal the specified value, an exception will be thrown indicating that the
JWT is invalid and may not be used.requireSubject in interface JwtParserMissingClaimException,
IncorrectClaimExceptionpublic JwtParser requireId(String id)
JwtParserjti exists in the parsed JWT. If missing or if the parsed
value does not equal the specified value, an exception will be thrown indicating that the
JWT is invalid and may not be used.requireId in interface JwtParserMissingClaimException,
IncorrectClaimExceptionpublic JwtParser requireExpiration(Date expiration)
JwtParserexp exists in the parsed JWT. If missing or if the parsed
value does not equal the specified value, an exception will be thrown indicating that the
JWT is invalid and may not be used.requireExpiration in interface JwtParserMissingClaimException,
IncorrectClaimExceptionpublic JwtParser requireNotBefore(Date notBefore)
JwtParsernbf exists in the parsed JWT. If missing or if the parsed
value does not equal the specified value, an exception will be thrown indicating that the
JWT is invalid and may not be used.requireNotBefore in interface JwtParserMissingClaimException,
IncorrectClaimExceptionpublic JwtParser require(String claimName, Object value)
JwtParserclaimName exists in the parsed JWT. If missing or if the parsed
value does not equal the specified value, an exception will be thrown indicating that the
JWT is invalid and may not be used.require in interface JwtParserMissingClaimException,
IncorrectClaimExceptionpublic JwtParser setClock(Clock clock)
JwtParserClock that determines the timestamp to use when validating the parsed JWT.
The parser uses a DefaultClock instance by default.public JwtParser setAllowedClockSkewSeconds(long seconds)
JwtParserexp
and nbf claims.setAllowedClockSkewSeconds in interface JwtParserseconds - the number of seconds to tolerate for clock skew when verifying exp or nbf claims.public JwtParser setSigningKey(byte[] key)
JwtParser
Note that this key MUST be a valid key for the signature algorithm found in the JWT header
(as the alg header parameter).
This method overwrites any previously set key.
setSigningKey in interface JwtParserkey - the algorithm-specific signature verification key used to validate any discovered JWS digital
signature.public JwtParser setSigningKey(String base64EncodedKeyBytes)
JwtParser
Note that this key MUST be a valid key for the signature algorithm found in the JWT header
(as the alg header parameter).
This method overwrites any previously set key.
This is a convenience method: the string argument is first BASE64-decoded to a byte array and this resulting
byte array is used to invoke JwtParser.setSigningKey(byte[]).
setSigningKey in interface JwtParserbase64EncodedKeyBytes - the BASE64-encoded algorithm-specific signature verification key to use to validate
any discovered JWS digital signature.public JwtParser setSigningKey(Key key)
JwtParser
Note that this key MUST be a valid key for the signature algorithm found in the JWT header
(as the alg header parameter).
This method overwrites any previously set key.
setSigningKey in interface JwtParserkey - the algorithm-specific signature verification key to use to validate any discovered JWS digital
signature.public JwtParser setSigningKeyResolver(SigningKeyResolver signingKeyResolver)
JwtParserSigningKeyResolver used to acquire the signing key that should be used to verify
a JWS's signature. If the parsed String is not a JWS (no signature), this resolver is not used.
Specifying a SigningKeyResolver is necessary when the signing key is not already known before parsing
the JWT and the JWT header or payload (plaintext body or Claims) must be inspected first to determine how to
look up the signing key. Once returned by the resolver, the JwtParser will then verify the JWS signature with the
returned key. For example:
Jws<Claims> jws = Jwts.parser().setSigningKeyResolver(new SigningKeyResolverAdapter() {
@Override
public byte[] resolveSigningKeyBytes(JwsHeader header, Claims claims) {
//inspect the header or claims, lookup and return the signing key
return getSigningKey(header, claims); //implement me
}})
.parseClaimsJws(compact);
A SigningKeyResolver is invoked once during parsing before the signature is verified.
This method should only be used if a signing key is not provided by the other setSigningKey* builder
methods.
setSigningKeyResolver in interface JwtParsersigningKeyResolver - the signing key resolver used to retrieve the signing key.public JwtParser setCompressionCodecResolver(CompressionCodecResolver compressionCodecResolver)
JwtParserCompressionCodecResolver used to acquire the CompressionCodec that should be used to
decompress the JWT body. If the parsed JWT is not compressed, this resolver is not used.
NOTE: Compression is not defined by the JWT Specification, and it is not expected that other libraries (including JJWT versions < 0.6.0) are able to consume a compressed JWT body correctly. This method is only useful if the compact JWT was compressed with JJWT >= 0.6.0 or another library that you know implements the same behavior.
JJWT's default JwtParser implementation supports both the
DEFLATE
and GZIP algorithms by default - you do not need to
specify a CompressionCodecResolver in these cases.
However, if you want to use a compression algorithm other than DEF or GZIP, you must implement
your own CompressionCodecResolver and specify that via this method and also when
building JWTs.
setCompressionCodecResolver in interface JwtParsercompressionCodecResolver - the compression codec resolver used to decompress the JWT body.public boolean isSigned(String jwt)
JwtParsertrue if the specified JWT compact string represents a signed JWT (aka a 'JWS'), false
otherwise.
Note that if you are reasonably sure that the token is signed, it is more efficient to attempt to parse the token (and catching exceptions if necessary) instead of calling this method first before parsing.
public Jwt parse(String jwt) throws ExpiredJwtException, MalformedJwtException, SignatureException
JwtParser
This method returns a JWT or JWS based on the parsed string. Because it may be cumbersome to determine if it
is a JWT or JWS, or if the body/payload is a Claims or String with instanceof checks, the
parse(String,JwtHandler) method allows for a type-safe callback approach that
may help reduce code or instanceof checks.
parse in interface JwtParserjwt - the compact serialized JWT to parseExpiredJwtException - if the specified JWT is a Claims JWT and the Claims has an expiration time
before the time this method is invoked.MalformedJwtException - if the specified JWT was incorrectly constructed (and therefore invalid).
Invalid
JWTs should not be trusted and should be discarded.SignatureException - if a JWS signature was discovered, but could not be verified. JWTs that fail
signature validation should not be trusted and should be discarded.JwtParser.parse(String, JwtHandler),
JwtParser.parsePlaintextJwt(String),
JwtParser.parseClaimsJwt(String),
JwtParser.parsePlaintextJws(String),
JwtParser.parseClaimsJws(String)protected JwtSignatureValidator createSignatureValidator(SignatureAlgorithm alg, Key key)
public <T> T parse(String compact, JwtHandler<T> handler) throws ExpiredJwtException, MalformedJwtException, SignatureException
JwtParserhandler with the resulting JWT or JWS instance.
If you are confident of the format of the JWT before parsing, you can create an anonymous subclass using the
JwtHandlerAdapter and override only the methods you know are relevant
for your use case(s), for example:
String compactJwt = request.getParameter("jwt"); //we are confident this is a signed JWS
String subject = Jwts.parser().setSigningKey(key).parse(compactJwt, new JwtHandlerAdapter<String>() {
@Override
public String onClaimsJws(Jws<Claims> jws) {
return jws.getBody().getSubject();
}
});
If you know the JWT string can be only one type of JWT, then it is even easier to invoke one of the following convenience methods instead of this one:
parse in interface JwtParsercompact - the compact serialized JWT to parseJwtHandlerExpiredJwtException - if the specified JWT is a Claims JWT and the Claims has an expiration time
before the time this method is invoked.MalformedJwtException - if the specified JWT was incorrectly constructed (and therefore invalid).
Invalid JWTs should not be trusted and should be discarded.SignatureException - if a JWS signature was discovered, but could not be verified. JWTs that fail
signature validation should not be trusted and should be discarded.JwtParser.parsePlaintextJwt(String),
JwtParser.parseClaimsJwt(String),
JwtParser.parsePlaintextJws(String),
JwtParser.parseClaimsJws(String),
JwtParser.parse(String)public Jwt<Header,String> parsePlaintextJwt(String plaintextJwt)
JwtParser
This is a convenience method that is usable if you are confident that the compact string argument reflects an unsigned plaintext JWT. An unsigned plaintext JWT has a String (non-JSON) body payload and it is not cryptographically signed.
If the compact string presented does not reflect an unsigned plaintext JWT with non-JSON string body,
an UnsupportedJwtException will be thrown.
parsePlaintextJwt in interface JwtParserplaintextJwt - a compact serialized unsigned plaintext JWT string.Jwt instance that reflects the specified compact JWT string.JwtParser.parseClaimsJwt(String),
JwtParser.parsePlaintextJws(String),
JwtParser.parseClaimsJws(String),
JwtParser.parse(String, JwtHandler),
JwtParser.parse(String)public Jwt<Header,Claims> parseClaimsJwt(String claimsJwt)
JwtParser
This is a convenience method that is usable if you are confident that the compact string argument reflects an
unsigned Claims JWT. An unsigned Claims JWT has a Claims body and it is not cryptographically
signed.
If the compact string presented does not reflect an unsigned Claims JWT, an
UnsupportedJwtException will be thrown.
parseClaimsJwt in interface JwtParserclaimsJwt - a compact serialized unsigned Claims JWT string.Jwt instance that reflects the specified compact JWT string.JwtParser.parsePlaintextJwt(String),
JwtParser.parsePlaintextJws(String),
JwtParser.parseClaimsJws(String),
JwtParser.parse(String, JwtHandler),
JwtParser.parse(String)public Jws<String> parsePlaintextJws(String plaintextJws)
JwtParser
This is a convenience method that is usable if you are confident that the compact string argument reflects a plaintext JWS. A plaintext JWS is a JWT with a String (non-JSON) body (payload) that has been cryptographically signed.
If the compact string presented does not reflect a plaintext JWS, an UnsupportedJwtException
will be thrown.
parsePlaintextJws in interface JwtParserplaintextJws - a compact serialized JWS string.Jws instance that reflects the specified compact JWS string.JwtParser.parsePlaintextJwt(String),
JwtParser.parseClaimsJwt(String),
JwtParser.parseClaimsJws(String),
JwtParser.parse(String, JwtHandler),
JwtParser.parse(String)public Jws<Claims> parseClaimsJws(String claimsJws)
JwtParser
This is a convenience method that is usable if you are confident that the compact string argument reflects a
Claims JWS. A Claims JWS is a JWT with a Claims body that has been cryptographically signed.
If the compact string presented does not reflect a Claims JWS, an UnsupportedJwtException will be
thrown.
parseClaimsJws in interface JwtParserclaimsJws - a compact serialized Claims JWS string.Jws instance that reflects the specified compact Claims JWS string.JwtParser.parsePlaintextJwt(String),
JwtParser.parseClaimsJwt(String),
JwtParser.parsePlaintextJws(String),
JwtParser.parse(String, JwtHandler),
JwtParser.parse(String)Copyright © 2018. All rights reserved.