Closes#328
- Ensured Parser worked with CharSequence, InputStream and Reader, not just String
- Changed Deserializer#deserialize(InputStream) to deserialize(Reader)
- JwtParser now extends from Parser to support these additional methods.
- Changed remaining JwtParser.parse* methods to accept CharSequence arguments instead of String args.
- Renamed X509Mutator#x509CertificateSha1Thumbprint to x509Sha1Thumbprint
- Renamed X509Mutator#x509CertificateSha256Thumbprint to x509Sha256Thumbprint
- Renamed X509Builder#withX509Sha1Thumbprint to x509Sha1Thumbprint
- Renamed X509Builder#withX509Sha256Thumbprint to x509Sha256Thumbprint
- Renamed X509Builder#x509CertificateChain to x509Chain
- Renamed X509Accessor#getX509CertificateChain to getX509Chain
- Renamed X509Accessor#getX509CertificateSha1Thumbprint getX509Sha1Thumbprint
- Renamed X509Accessor#getX509CertificateSha256Thumbprint to getX509Sha256Thumbprint
- Renamed JwtParserBuilder#enableUnsecured() to unsecured()
- Renamed JwtParserBuilder#enableUnsecuredDecompression() to unsecuredDecompression()
- Renamed KeyOperationPolicyBuilder#allowUnrelated(boolean) to unrelated() (removed boolean argument also to be consistent with JwtParserBuilder#unsecured())
Closes#837
Replaced raw `String` and `byte[]` usages with `CharSequence`, `InputStream`/`OutputStream` and `CharBuffer`/`ByteBuffer` concepts where possible to eliminate unnecessary creation of intermediate byte arrays and/or temporary Strings.
-----
- Changed TokenizedJwt and TokenizedJwe interfaces and implementations to return CharSequences instead of Strings to avoid creating new Strings on the heap
- Changed internal Base64 implementation to work with a CharSequence instead of a raw char[] to reduce need to create new arrays on the heap
- Changed Base64Decoder generics signature from Decoder<String,byte[]> to Decoder<CharSequence,byte[]>
- Decoders.BASE64 and Decoders.BASE64URL now reflect Decoder<CharSequence,byte[]>
- Changed Strings#utf8 implementation to accept a CharSequence instead of a String
- Added new Strings#wrap to wrap a CharSequence into a CharBuffer if necessary
- Renamed not-yet-released JwtBuilder#serializer method with JwtBuilder#json
- Renamed not-yet-released JwtParserBuilder#deserializer method with JwtParserBuilder#json
-----
- Moved JwtDeserializer from io.jsonwebtoken.impl to io.jsonwebtoken.impl.io package, created two new subclass implementations for use with Jwks and JwkSets
- Renamed JwtDeserializer to JsonObjectDeserializer that defaults to throwing MalformedJwtException. Added two subclasses, JwkDeserializer and JwkSetDeserializer that throws JWK and JWK Set-specific exceptions.
-----
Changed ParserBuilder#deserializer method name to ParserBuilder#jsonReader
-----
Removed all usages of Serializer#serialize and Deserializer#deserialize except for deprecated implementations. All other usages now use InputStream/OutputStream concepts
-----
Added Jwks#json and Jwks#UNSAFE_JSON for assistance in serializing JWKs to JSON (test cases, README examples, etc)
-----
- Ensured Encoder and CompressionAlgorithm supported streams instead of just byte arrays
- Copied over necessary (Apache-licensed) code from Apache commons-codec to obtain Base64OutputStream and Base64InputStream capability for efficient encoding during compact JWT creation. Hopefully this is temporary and we can strip out most if not all of this and modify our existing Base64.java class for simpler support since we have many less use cases than what commons-codec supports. All implementations are now in the `impl` module only.
-----
Converted all DigestAlgorithms to utilize an InputStream for data instead of byte[]
-----
- Added JwtBuilder InputStream payload support: added JwtBuilder#content(InputStream), JwtBuilder#content(InputStream, String contentType), JwtBuilder#content(String, String contentType)
- Added CountingInputStream as a way to check and assert that b64/unencoded payload InputStreams cannot be empty.
------
Renamed Encoder/Decoder and CompressionAlgorithm 'wrap' methods to encode/decode/compress/decompress for better readability and to make clearer the intent of the method. Also to avoid name/text/search collisions with 'wrap' references.
-----
Renamed new JwtBuilder#encoder and JwtParserBuilder#decoder methods to JwtBuilder#b64Url and JwtParserBuilder#b64Url for shorter method chains
-----
- Updated AeadAlgorithm and its AeadRequest/AeadResult concepts to utilize Input/Output Streams
- Renamed InitializationVectorSupplier to IvSupplier (was verbose, and it's a new interface, and it's not commonly referenced in the API, so the extra verbosity isn't needed)
* Update groovy patch version to support Java 21.
NOTE: This adds a Maven profile that ups the source/target version to Java 8, but ONLY when building with 21+
The first ServiceLoaders found when looking up a class will be cached. This cache can be reset by calling `Services.reload()`, to help
facilitate testing or instances where a classpaths are dynamically changed at runtime.
Fixes: #752
Closes#515
[RFC 7797)(https://www.rfc-editor.org/rfc/rfc7797.html) support.
JwsHeader:
- Added new JwtHeader#isPayloadEncoded() to check for `b64` in crit values and as parameter value.
JwtBuilder:
- Added new #content(String) method for non-detached unencoded payloads
- Added new #encodePayload(boolean) method to disable payload Base64URL-encoding
JwtParserBuilder:
- Added new #critical(String) convenience method to append to the crit set
JwtParser:
- Added new #parseContentJws(String, byte[]) method to allow supplying detached payloads for signature verification at parse time
- Added new #parseClaimsJws(String, byte[]) method to allow supplying detached serialized JSON claims for signature verification at parse time
- Added all backing implementations and test cases to 100% coverage
- Added RFC7797Test class for bulk of this RFC's tests so they don't get 'lost' in the already-too-large JwtsTest class
- README.md documentation added in JWS section
- CHANGELOG.md updated
* Changed usages of UnsupportedKeyException to only those where a given key is actually not understood. Cases where the key is not valid for the current use case was changed to throw InvalidKeyException instead to better indicate validation failure.
* Changed superclass of UnsupportedKeyException to KeyException instead of InvalidKeyException (unsupported means 'I don't know what this key is', whereas InvalidKeyExceptions mean 'the key failed validation'). An unsupported key is not necessarily invalid, it just means we don't know how to handle it.
* Adjusted JWK .equals implementations to only account for kty value and material fields (two JWKs are equal if their type and key material are equal, regardless of other public parameters and/or custom name/value pairs).
* Adjusted JWK .hashCode implementation to pre-cache its value based on JwkThumpbrint fields since JWKs are immutable
* Ensured `aud` claim is an array by default, but allows a single string value on creation for recipients that do not understand array values:
- ClaimsMutator#audience(String) now appends to the `aud` set, and may be called multiple times
- Added new ClaimsMutator#audience(Collection) method for setting/full replacement
- Added new ClaimsMutator#audienceSingle for setting/full replacement of single string value
- Marked ClaimsMutator#audienceSingle as Deprecated (even though it's not!) to discourage its use when possible.
* Added new KeyOperation and KeyOperationBuilder concepts
Changed Jwk#getOperations and JwkBuilder#operations from methods that accepted and returned Strings to use new KeyOperation instances
Added Jwks.OP#builder() method to create a KeyOperationBuilder
* Changed Jwks.OP#WRAP to WRAP_KEY and UNWRAP to UNWRAP_KEY to match RFC names
* Added new KeyOperationPolicy and KeyOperationPolicyBuilder concepts
Added Jwks.OP#policy() builder method to create a KeyOperationPolicyBuilder
Added JwkBuilder#operationPolicy and JwkParserBuilder#operationPolicy methods for configuring custom KeyOperationPolicy instances during JWK building and parsing, respectively.
* Added regression tests for #365
* Removed default doDigest implementation from AbstractSecureDigestAlgorithm and put it in DefaultMacAlgorithm (where it should have been) since SignatureAlgorithms override it already
* Enabled key-specific Provider support during JwtParser execution. Usage patterns and documentation updated inn JwtParserBuilder#keyLocator and README.md.
* Updated Table of Contents with link to Key Locator key-specific Provider section
* Added Pkcs11Test test case that ensures explicit .provider calls for all JWS and JWE operations are not needed when the PKCS11 provider is installed in the JVM via Security.addProvider
* Removed unnecessary CryptoAlgorithm#nonPkcs11Provider method
* Ensured RSA key validation implementation is consistent with name/available-length validation checks in other SecureDigestAlgorithm implementations
* Added impl/src/main/resources/io/jsonwebtoken/impl/security/genkeys script for reuse/simplicity and help in CI
* Updated tests reflecting updated test key material from genkeys script
* Fixed license headers for newly generated test key files
* Removed conditional check for X448 and X25519 certificate/chains now that we have signed certs for those test key files
* Added new impl/src/test/scripts/softhsm script with `configure` and `import` subcommands for working with SoftHSMv2, used locally and in CI
* Enabling PKCS11 keystore interaction on macos and linux (CI) via Pkcs11Test
* Added new AbstractCurve#contains method and leveraged that to clean up code considerably in EcdhKeyAlgorithm.java
* Updated softhsm script to ensure EC key import used the pkcs11-tool `--usage-derive` flag to allow testing PKCS11 keys with ECDH-ES key algorithms
* Renamed CryptoAlgorithm#generateKey to #generateCek to be more explicit in its purpose.
* Introduced new CryptoAlgorithm#nonPkcs11Provider to ensure PKCS11 provider won't be used when key material is required (i.e. for ephemeral key(pair) KeyAlgorithms).
* Ensured CryptoAlgorithm#generateCek ignored applying a PKCS11 provider since required key material wouldn't be available otherwise.
* Ensured DefaultJwtBuilder and DefaultJwtParser would use the provider for the KeyAlgorithm, but not for the AeadAlgorithm (unless using direct encryption)
* Consolidated unsigned byte array length calculation for non-negative integers (used in a few places) to a new Bytes#uintLength method. Refactored other classes to use this new method to eliminate code duplication
* Added tests for JWS MAC algorithms (HS256, HS384, HS512) with PKCS11 secret keys
* Explicitly prevented Password instances in DefaultMacAlgorithm
* Fixed the EdwardsCurve#keyBitLength implementation to accurately reflect RFC key sizes and not encoded byte array sizes.
* OptionalMethodInvoker now supports static invocations in addition to the existing instance invocation support.
- Changed EC point multiplication montgomery ladder iteration to be a little faster (still has fixed number of operations of course)
- Moved Weierstrass calc/utility methods to ECCurve instead of AbstractEcJwkFactory
- Removed unnecessary Curves.java since StandardCurves is the preferred implementation
- Renamed CurvesTest to StandardCurvesTest
* Consolidating BouncyCastle lookup/fallback behavior to JcaTemplate to avoid complexity in Algorithm implementations
* Added JcaTemplate generateX509Certificate helper method to enable BC-fallback behavior if necessary
* Further reduced code dependencies on Providers class. Now only used by JcaTemplate, JcaTemplateTest and ProvidersTest
* Removed Condition and Conditions concepts - no longer needed now that Providers.java no longer requires conditional loading
* Made Curve concept part of the public API for key generation, and added Jwks.CRV utility class to reference standard curves
- Ensured PS256, PS384, and PS512 pem-encoded test key files accurately represented the rsassa-pss algorithmId (OID) with appropriate hash/mgf1 properties.
- Removed Jwts.SIG#Ed25519 and Jwts.SIG#Ed448 since they were only there for key generation and those keys can now be generated via the Jwks.CRV#Ed25519 and Jwks.CRV#Ed448 references.
- Consolidated duplicate use/key_ops logic for checking sig/sign/verify between SecretJwkFactory and RsaPrivateJwkFactory into JwkContext.isSigUse()
- Ensured if JwkContext.isSigUse() is true, and a JWK (from values only) is RSA and RSASSA-PSS is available (JDK 11+ or BC enabled), that the JWK's generated RSAPublicKey and RSAPrivateKey use the RSASSA-PSS algorithm instead of just RSA.
- Enforced that RSASSA-PSS keys cannot be used for encryption in the RSA KeyAlgorithm implementation (would be a security risk otherwise).
- Enforced that RSA encryption keys cannot be used to create RSASSA-PSS digital signatures (but can verify them) ala the "robustness principle" (to reduce security exposure).
- Ensured README.md and JavaReadmeTest reflected Jwks.CRV usage for keypair generation.
* Added TestCertificates workaround for https://bugs.openjdk.org/browse/JDK-8242556
* Added JwtX509StringConverter workaround for https://bugs.openjdk.org/browse/JDK-8242556
* Added JwtX509StringConverter workaround for https://bugs.openjdk.org/browse/JDK-8242556
* Reverted to former RsaSignatureAlgorithm logic for PSS key validation (no prevention of rsaEncryption keys with PSS) as RFC 7520 test vectors show using a standard RSA key to compute a PSS signature in https://www.rfc-editor.org/rfc/rfc7520.html#section-4.2.1
* Ensured Jwk tests that used RSASSA-PSS keys (from openssl files) used the BC provider since RSASSA-PSS isn't available natively before JDK 11
* Restored TestCertificates logic needed to address JDK 11 bug during tests https://bugs.openjdk.org/browse/JDK-8213363 (fixed in JDK 12+)
- Renamed Keys.forPassword to slightly cleaner/less verbose Keys.password
- Ensured ClaimsMutator extends MapMutator
- Ensured JwtBuilder verifyWith is overloaded and accepts only SecretKey and PublicKey instances
- Ensured JwtBuilder decryptWith is overloaded and accepts only SecretKey and PrivateKey instances
- Renamed JwtParserBuilder#enableUnsecuredJwts() to enableUnsecured() since any JWT or JWS without a header (or with an alg of none) are both considered 'unsecured', so the suffix was removed to avoid confusion.
- Renamed MapMutator `set` methods to `add` methods to avoid Java setter full replacement idiom confusion (as opposed to add/append)
- Removed MapMutator superinterface from ClaimsBuilder. Generic map mutation methods on the JwtBuilder are a little confusing.
- Added JwtBuilder#claims() method that returns a Claims mutator with an and() method to get back to the JwtBuilder
- Added a convenience JwtBuilder#claims(Map) method (modern builder-style name)
- Added a new JwtBuilder#encoder to eventually replace the now-deprecated JwtBuilder#base64UrlEncodeWith method
- Added a new JwtBuilder#serializer to eventually replace the now-deprecated JwtBuilder#serializeToJsonWith method
- Renamed JwtParserBuilder#base64UrlDecoder to just JwtParserBuilder#decoder
- Renamed JwtParserBuilder#jsonDeserializer to just JwtParserBuilder#deserializer
- Lots of README.md updates to reflect builder api name changes
- Renamed KeyBuilderSupplier#keyBuilder() to less verbose KeyBuilderSupplier#key()
- Renamed KeyPairBuilderSupplier#keyPairBuilder() to less verbose KeyPairBuilderSupplier#keyPair()
- Renamed ProtoJwkBuilder to DynamicJwkBuilder
- Renamed JwtBuilder.Header to JwtBuilder.BuilderHeader to avoid naming/import conflict with io.jsonwebtoken.Header
- Renamed JwtBuilder.Claims to JwtBuilder.BuilderClaims to avoid naming/import conflict with io.jsonwebtoken.Claims
- removed DynamicJwkBuilder chain methods with array arguments
- added generic DynamicJwkBuilder#keyPair(KeyPair) method
- added generic DynamicJwkBuilder#chain method
- Reintroduced deprecated Header mutation methods for a slightly easier transition to 0.12.0, will remove in next release
- Deprecated public String constants in Header.java and JwsHeader.java
- Documentation, JavaDoc and code example changes/formatting fixes and enhancements
* - JwtParser is now immutable (no mutation methods, `final` internal state, etc).
- Jwts.parser() has been changed to return a `JwtParserBuilder`, Jwts.parserBuilder() has been removed since it's now superfluous.
- LegacyServices.java has been deleted since DefaultJwtParser is no longer mutable (it was used in the parse() method. This logic is now only performed via the Services.java implementation used by the JwtParserBuilder).
- ImmutableJwtParser.java has been deleted since it was a wrapper around a mutable DefaultJwtParser implementation. Now that DefaultJwtParser is immutable, ImmutableJwtParser.java is no longer necessary.
* Jwts#header() and JwtBuilder#header() API cleanup
* added license headers, removed unused Conjunctor interface concept
* impl checkpoint for Registry-to-Map implementation change
* Jwts.SIG and Jwts.ENC conversion checkpoint (complete)
* Jwts.KEY and Jwks.HASH conversion checkpoint (complete)
* File header and Javadoc cleanup. Removed unused SignatureRequest.java concept.
* Changed deprecated API usage in test case
* - Removed *Accessor concepts where possible, just using the *Header interfaces was sufficient
- KeyAlgorithm#getEncryptionKey now accepts a JweHeader that is mutable. Implementations can just use Map#put to modify the header state if desired.
* MapMutator method renaming to avoid odd conventions
* introduced ProtectedJwt concept and intermediate DefaultProtectedJwt implementation
* Removed all usages of CompressionCodecs.java in favor of a new Jwts.ZIP entry.
Renamed all Standard***AlgorithmsBridge to Standard***Algorithms
* CompressionCodec to CompressionAlgorithm transition (complete, code coverage 100%)
* JWE support. Resolves#113
Huge feature/code change - see CHANGELOG.MD for an in-depth review of changes.
Commit note log:
- Added JWE AeadAlgorithm and KeyAlgorithm and supporting interfaces/implementations, and refactored SignatureAlgorithm to be an interface instead of an enum to enable custom algorithms
- NoneSignatureAlgorithm cleanup. Added UnsupportedKeyExceptionTest.
- Added JWK support!
* Removed the previous SignatureAlgorithm implementation concepts (Provider/Signer/Validator implementations). Implementations are now interface-driven and fully pluggable.
* adding tests, working towards 100% coverage. Moved api static factory class tests to impl module to avoid mocking static calls due to bridge/reflection logic.
* adding tests, removed unused class
* implementation checkpoint (safety save)
* clean build checkpoint
* continued testing w/ more coverage. Replaced PbeKey concept with PasswordKey
* fixed erroneous optimize imports
* Added ECDH-ES key algorithms + RFC tests
* 1. Enabled targeted/limited use of BouncyCastle only when required by eliminating use of RuntimeEnvironment in favor of new Providers implementation. JJWT will no longer modify the system providers list.
2. Changed SecretKeyGenerator.generateKey() to KeyBuilderSupplier.keyBuilder() and a new SecretKeyBuilder interface. This allows users to customize the Provider and SecureRandom used during key generation if desired.
3. Added KeyLengthSupplier to allow certain algorithms the ability to determine a key bit length without forcing a key generation.
4. Ensured Pbes2 algorithms defaulted to OWASP-recommended iteration counts if not specified by the user.
* 1. EcdhKeyAlgorithm: consolidated duplicate logic to a single private helper method
2. Updated RequiredTypeConverter exception message to represent the expected type as well as the found type
* Minor javadoc update
* 1. Javadoc cleanup.
2. Ensured CompressionException extends from io.jsonwebtoken.io.IOException
3. Deleted old POC unused JwkParser interface
4. Ensured NoneSignatureAlgorithm reflected the correct exception message for `sign`
* Fixed erroneous JavaDoc, enhanced code coverage for DefaultClaims
* Added jwe compression test
* Added TestKeys concept for Groovy test authoring
* Added tests, cleaned up state assertions for code coverage
* Added tests, cleaned up state assertions for code coverage
* Removed unused code
* Merge branch 'master' into jwe-merge
* using groovy syntax to avoid conflict with legacy SignatureAlgorithm type
* JavaDoc fixes
* JavaDoc fixes, test additions to work on JDK >= 15
* JavaDoc fixes, test additions to work on JDK 7 and JDK >= 15
* Test adjustment to work on Java 7
* Test adjustment to work on Java 7
* code coverage work cont'd
* code coverage work cont'd
* JavaDoc fix
* Update impl/src/main/java/io/jsonwebtoken/impl/JwtTokenizer.java
Co-authored-by: sonatype-lift[bot] <37194012+sonatype-lift[bot]@users.noreply.github.com>
* lift edits
* lift edits
* lift edits
* code coverage testing cont'd
* PayloadSupplier renamed to Message
* Added new KeyPairBuilder/KeyPairBuilderSupplier for parity with KeyBuilder/KeyBuilderSupplier. Switched all generate* calls to use the new API methods.
* - Added lots of JavaDoc
- JwtMap: Ensured Groovy GString implementations that invoke Groovy's InvokerHelper on a JwtMap implementation will print redacted values instead of the actual secret values.
* - JavaDoc additions cont'd
* - JavaDoc additions and syntax cleanup cont'd
- Minor work to fix compilation errors on a few Groovy test classes
* - JavaDoc additions and syntax cleanup cont'd
- Minor work to fix compilation errors on a few Groovy test classes
* - JavaDoc additions and syntax cleanup cont'd
- Minor work to fix compilation errors on a few Groovy test classes
* - JavaDoc additions and syntax cleanup cont'd
- Minor work to fix compilation errors on a few Groovy test classes
* - JavaDoc cont'd
* Code coverage updates cont'd
* Propagating exception wrapper function enhancements
* 100% code coverage!
* Minor test changes to work with JDK >= 11
* Ensured all JWK secret or private values were wrapped in a RedactedSupplier instance to prevent accidental printing of secure values
* - Updated JavaDoc to reflect JWK toString safety and property access
- Updated README to reflect new GsonSerializer requirements for io.jsonwebtoken.lang.Supplier
* Documentation enhancements
* Fixed erroneous JavaDoc element
* Fixed LocatorAdapter usage now that it's abstract
* Minor JavaDoc fix
* JavaDoc is now complete (no warnings) for api module
* Ensured JWS signatures are computed first before deserializing the body if no SigningKeyResolver has been configured.
* Removed EllipticCurveSignatureAlgorithm and RsaSignatureAlgorithm concepts due to some PKCS11 and HSM security providers that cannot provide keys that implement the ECKey or RSAKey interfaces.
* Removed reliance on io.jsonwebtoken.security.KeyPair now that KeyPairBuilder implementations cannot guarantee RSAKey or ECKey types
* Ensured RsaKeyAlgorithm used PublicKey and PrivateKey parameters due to PKCS11 and HSM key stores that may not expose the RSAKey interface on their RSA key implementations
* cleaned up EC point addition/doubling logic to be more readable and match equations in literature
* Deprecated JwtParserBuilder setSigningKey* methods in favor of verifyWith for name accuracy and congruence with decryptWith
* Added PositiveIntegerConverter and PublicJwkConverter for JWE Header "p2c" and "jwk" fields
* Ensured CompressionCodec inherited Identifiable for consistency w/ all other algorithms
* Ensured CompressionCodec inherited Identifiable for consistency w/ all other algorithms
* Ensured CompressionCodec inherited Identifiable for consistency w/ all other algorithms
* JavaDoc enhancement
* Added Jwks.parserBuilder(), JwkParserBuilder and JwkParser concepts
* Ensured ProtoJwkBuilder method names were all congruent (remaining set* methods were renamed to for*)
* Minor JavaDoc organization change
* Changed JweBuilder to have only two encryptWith* methods for consistency with JwtBuilder signWith* methods. Also prevents incorrect configuration by forgetting to call follow-up methods.
* Removed DefaultValueGetter in favor of new FieldReadable concept to leverage Field instances instead of duplicating logic.
* Adding copyright headers
* Deprecated CompressionCodecResolver in favor of Locator<CompressionCodec>
* Deprecated CompressionCodecResolver in favor of Locator<CompressionCodec>
* Folded in JweBuilder concept and implementation into the existing JwtBuilder
* Cleanup to reduce duplicate logic
* Changed plaintext JWT payload type from String to byte[]
* Minor internal doc fixes
* - Added UnprotectedHeader interface
- Renamed DefaultHeader to AbstractHeader
- Renamed JwtParser 'plaintext'* methods to 'payload'* methods to more accurately reflect the JWT nomenclature
* Updated changelog to reflect the following changes:
- Added UnprotectedHeader interface
- Renamed DefaultHeader to AbstractHeader
- Renamed JwtParser 'plaintext'* methods to 'payload'* methods to more accurately reflect the JWT nomenclature
* Adding RFC 7520 test cases.
* Changed JwtBuilder/JwtParser/JwtHandler/JwtHandlerAdapter `payload` concept to `content` concept
* JavaDoc error fix
* Added JwtParserBuilder#addCompressionCodecs method and supporting tests
* Updated changelog to reflect recent changes
* doc updates
* Fixed minor types in JWE related change log
* Enabled Mutator and HeaderBuilder interfaces and implementations
* Fixed erroneous JavaDoc
* Added additional .pem files for testing PEM parsing (TBD at a later date)
* Updating documentation to prepare for JWE release
* more docs
* docs cont'd
* Update README.md
Trying to prevent table wrap
* Update README.md
testing table whitespace wrap
* Update README.md
formatting testing
* Update README.md
formatting testing cont'd
* docs cont'd
* docs cont'd
* docs cont'd
* documentation checkpoint
* documentation checkpoint, still work in progress
* added extra info about Android BouncyCastle registration
* added extra info about Android BouncyCastle registration
* added extra info about Android BouncyCastle registration
* documentation cont'd
* documentation cont'd
* documentation cont'd
* documentation cont'd
* documentation cont'd
* Upgraded Jackson to 2.12.7 due to Jackson CVE
* trying to get sonatype lift working again
* Removed unnecessary println statement in test
* Added JDK 19
* Removing JDK 19 until we can resolve incompatible groovy version
* doc formatting test
* Update README.md
Fixed 'JWE Encryption Algorithms' table formatting
* renamed PasswordKey to just Password, removed unnecessary WrappedSecretKey class and its one usage in favor of JDK-standard SecretKeySpec
* Updated PasswordKey references to Password
* Renamed DefaultPassword to PasswordSpec while also implementing KeySpec per JDK conventions.
* documentation cont'd
* documentation cont'd
* documentation cont'd
* JWT expired exception is now shows difference as now - expired
Instead of now + skew - expired
Fixes: #660
* documentation cont'd
* Fixed erroneous error message (should be '521' not '512').
* - Removed EcKeyAlgorithm and RsaKeyAlgorithm in favor of KeyAlgorithm<PublicKey, PrivateKey> due to HSM key types unable to conform to respective ECKey or RSAKey types
- added Curve concept with DefaultCurve and ECCurve implementations for use across EC/EdEC SignatureAlgorithm and KeyAlgorithm implementations
- disabled Zulu JDK 10 - compiler was failing, and that is a short-term-supported version anyway
- added Temurin JDK 19 and Zulu JDK 19 to the build
* Removed JDK 19 builds due to error with Groovy compiler version compatibility
* removed unused test, created https://github.com/jwtk/jjwt/issues/765 to address later
* updated test case to reflect Edwards keys algorithm name differences between BouncyCastle and JDK 11/15
* - Reordered JwtBuilder .encryptWith method arguments to match signWith conventions
- Added key validation logic to DefaultRsaKeyAlgorithm
* - Reordered JwtBuilder .encryptWith method arguments to match signWith conventions
- Added key validation logic to DefaultRsaKeyAlgorithm
- Removed mutation methods on InvalidClaimException and its subclasses, IncorrectClaimException and MissingClaimException
- renamed Jwks.parserBuilder() to Jwks.parser() to reduce verbosity since we'll never likely offer a Jwts.parser() that returns a Parser instance directly.
* Documentation updates
* Documentation updates
* Documentation updates
* Adding Java-based tests for README.md code snippets (e.g. new Examples section).
* Testing README code snippet in examples
* Testing README code snippet in examples
* Testing README code snippet in examples
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Ensured README.md examples would compile/run by testing code in a JavaReadmeTest.java class
* Testing coveralls failure fix for JavaReadmeTest (unnecessary for coverage)
* Message* API refactoring cleanup
* Refactored SignatureAlgorithm(s) concept as a new DigestAlgorithm hierarchy to support non-keyed digests, as well as to reflect correct cryptographic taxonomy. Renamed SignatureAlgorithms utility class to JwsAlgorithms.
* - Added JwkThumbprint and JWK Thumbprint URI support
- Fixed various copyright headers
* Updated README with JWK examples
* - Added logic and test to ensure Parser builder does not allow both a signature verification key and SigningKeyResolver to be configured.
- Updated README code example, and added test for verification
* - Added proactive checks to ensure PublicKey instances cannot be specified on JwtBuilder to create digital signatures
- Added additional tests to ensure that Password instances cannot be used with Mac algorithm instances (HS256, HS384, HS512, etc)
* minor edit to reflect latest # of test cases
* Minor JavaDoc improvement
* Disabled parsing of unsecured compressed payloads by default, with a JwtParserBuilder#enableUnsecuredDecompression method added for override if necessary.
* Refactored JcaTemplate to avoid reflection
* minor readme clarification
* Edwards Curve keys checkpoint
* Edwards Curve keys and related functionality checkpoint. Added lots of tests.
* Edwards Curve keys and related functionality checkpoint. Reached 100% code coverage.
* Addressed EdwardsCurve differences (and a JDK 11 PKCS8 encoding bug) between JDK versions (1.7 through 15+).
* Addressed EdwardsCurve differences (and a JDK 11 PKCS8 encoding bug) between JDK versions (1.7 through 18).
* Adding --add-opens lines to surefire/test config to avoid unnecessary build warnings
* Improved Edwards Key encoding error checks
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* added some code to test errors in CI
* Improved Field/FieldBuilder implementation to make it more robust and catch type errors. JwkBuilder/Factory refactoring is likely to follow on subsequent commits.
* Updating CI config to use the Oracle no-fee JDK builds
* Updating CI config to use the Oracle no-fee JDK builds
* Updating CI config to use the Oracle no-fee JDK builds
* JavaDoc fixes
* JavaDoc fixes
* JavaDoc fixes
* Ensured license headers are updated with correct dates based on git history, as well as ensured this is enforced in CI
* fixed various build warnings and javadoc errors
* Maven license plugin config cleanup. Removed now-unused header_format.xml file.
* fixed javadoc error causing build failures
* Changed Algorithms + Bridge concept to allow nested inner classes for simpler authoring all stemming from an 'Algorithms' class (easier to find algorithms via code completion than knowing off the top of your head which *Algorithms classes to reference).
* Added license headers
* Moved JwsAlgorithms to an inner class of Algorithms. Will rename to `StandardSecureDigestAlgorithms` to maintain the convention used with the other Algorithms inner classes.
* Extracting Algorithms inner classes up a level - cleaner/easier to maintain, document and reference as JavaDoc links.
* Extracting Algorithms inner classes up a level - cleaner/easier to maintain, document and reference as JavaDoc links. Renamed JwsAlgorithms to StandardSecureDigestAlgorithms to retain the JDK 'Standard*' convention.
* Removed Algorithms class in favor of direct `Standard*` `Registry` references in `Jwts` and `Jwks` helper classes to keep the references 'close' to where they are used the most.
* Minor README.md documentation updates.
* Copying over 6e74486 to test on the jwe branch
* Ensured CI license-check build pulls full (non-shallow) git history to perform full year checks.
* JavaDoc + impl + test checkpoint
* JavaDoc + impl + test checkpoint. Returned to 100% code coverage
* JavaDoc + impl + test checkpoint. Returned to 100% code coverage
* - Ensured Edwards Curve keys (X25519 and X448) worked with ECDH-ES algorithms
- Ensured JWT Header ephemeral PublicKey ('epk' field) could be any Public JWK, not just an EcPublicJwk
- Updated README.md to ensure the installation instructions for uncommenting BouncyCastle were a little less confusing (having commented out stuff be at the end of the code block so it couldn't be confused with other lines)
* Ensured correct message assertion on all JDKs (value was different on JDK 15 and later)
* Ensured correct message assertion on all JDKs (value was different on JDK 15 and later)
* - enabled more IANA algorithms in StandardHashAlgorithms
- JavaDoc update
* - JavaDoc fixes/enhancements
- Fixed erroneous README.md method name reference
- ensured DefaultJwkContext#getName() supports Octet keys as well.
* - JavaDoc fixes/enhancements
* - JavaDoc fixes/enhancements required to pass the build on later JDKs
* Minor JavaDoc typo fix
* Finished implementing all [RFC 8037](https://www.rfc-editor.org/rfc/rfc8037) test vectors in the Appendix
* Removed accidentally-committed visibility modifier
* Added copyright header
* Enabled PublicKey derivation from Edwards curve PrivateKey
* Enabled PublicKey derivation from Edwards curve PrivateKey. Updated documentation and code example showing this.
* Enabled PublicKey derivation from Edwards curve PrivateKey. Updated documentation and code example showing this.
* Doc update to reference Octet JWK RFC.
* Minor JavaDoc fix
* Fixed OctetPrivateJwk discrepancy with generic parameter ordering (compared to other PrivateJwk interfaces)
* Changed Jwts.header to Jwts.unprotectedHeader, and Jwts.headerBuilder is now Jwts.header
---------
Co-authored-by: sonatype-lift[bot] <37194012+sonatype-lift[bot]@users.noreply.github.com>
Co-authored-by: Brian Demers <bdemers@apache.org>
Versions after this fail to copy symlinks (used for impl crypto tests)
This should be fixed in a future version of the maven-resources-plugin (MRESOURCES-269), but should be pinned anyway
* Adds new connivence module, in place of the old io.jsonwebtoken:jjwt module
Some folks are unaware of newer JJWT versions because they are still using the old io.jsonwebtoken:jjwt module. This makes automatic version updates tools "just work" for them
NOTE: This new module is _basically_ an empty jar, that adds `jjwt-api` (compile scope), `jjwt-impl` (runtime scope), and `jjwt-jackson` (runtime scope) transitive dependencies.
* Minor cleanup before changing `all` directory name
* Renamed `all` to `tdjar` (transitive dependency jar)
Co-authored-by: Les Hazlewood <121180+lhazlewood@users.noreply.github.com>
lhazlewood
Brian Demers
Micah Silverman
Dabeen Jeong
tungj
Ivan Matthew
dependabot[bot]
Lena Schimmel
Mats Rydberg