Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
This commit is contained in:
Tran Ngoc Nhan 2025-03-27 19:29:15 +07:00 committed by Josh Cummings
parent bdbf6a2be3
commit 3be8e92187
2 changed files with 2 additions and 2 deletions

View File

@ -2,7 +2,7 @@
== Validate `typ` Header with `JwtTypeValidator`
`NimbusJwtDecoder` in Spring Security 7 will move `typ` header validation to `JwtTypeValidator` intsead of relying on Nimbus.
`NimbusJwtDecoder` in Spring Security 7 will move `typ` header validation to `JwtTypeValidator` instead of relying on Nimbus.
This brings it in line with `NimbusJwtDecoder` validating claims instead of relying on Nimbus to validate them.
If you are changing Nimbus's default type validation in a `jwtProcessorCustomizer` method, then you should move that to `JwtTypeValidator` or an implementation of `OAuth2TokenValidator` of your own.

View File

@ -398,7 +398,7 @@ fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain
----
======
This is handy when deeper configuration, such as <<webflux-oauth2resourceserver-opaque-authorization-extraction,authority mapping>>or <<webflux-oauth2resourceserver-opaque-jwt-introspector,JWT revocation>>, is necessary.
This is handy when deeper configuration, such as <<webflux-oauth2resourceserver-opaque-authorization-extraction,authority mapping>> or <<webflux-oauth2resourceserver-opaque-jwt-introspector,JWT revocation>>, is necessary.
[[webflux-oauth2resourceserver-opaque-introspector-bean]]
=== Exposing a `ReactiveOpaqueTokenIntrospector` `@Bean`