From c3e5f952425b98bcf5147045ace0976cfc3e3def Mon Sep 17 00:00:00 2001 From: Martin Treurnicht Date: Thu, 30 Jun 2016 13:46:07 -0700 Subject: [PATCH] Added more descriptive backwards compatibility information --- .../impl/crypto/EllipticCurveSignatureValidator.java | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/main/java/io/jsonwebtoken/impl/crypto/EllipticCurveSignatureValidator.java b/src/main/java/io/jsonwebtoken/impl/crypto/EllipticCurveSignatureValidator.java index 7d9435ec..09ab14db 100644 --- a/src/main/java/io/jsonwebtoken/impl/crypto/EllipticCurveSignatureValidator.java +++ b/src/main/java/io/jsonwebtoken/impl/crypto/EllipticCurveSignatureValidator.java @@ -41,7 +41,13 @@ public class EllipticCurveSignatureValidator extends EllipticCurveProvider imple PublicKey publicKey = (PublicKey) key; try { int expectedSize = getSignatureByteArrayLength(alg); - //if the expected size is not valid for JOSE, fall back to ASN.1 DER signature + /** + * + * If the expected size is not valid for JOSE, fall back to ASN.1 DER signature. + * This fallback is for backwards compatibility ONLY (to support tokens generated by previous versions of jjwt) + * and backwards compatibility will possibly be removed in a future version of this library. + * + * **/ byte[] derSignature = expectedSize != signature.length && signature[0] == 0x30 ? signature : EllipticCurveProvider.transcodeSignatureToDER(signature); return doVerify(sig, publicKey, data, derSignature); } catch (Exception e) {