Package org.apache.juneau.rest.server.auth.jwt

package org.apache.juneau.rest.server.auth.jwt
JWT bearer-token validation backed by com.nimbusds:nimbus-jose-jwt.

This is the optional companion to BearerTokenGuard in juneau-rest-server. Adding this module to a service's classpath lets the bearer guard delegate to JwtTokenValidator for full JWT validation (signature, iss, aud, exp, nbf) without bringing the nimbus library into the core juneau-rest-server jar.

Containment

The nimbus-jose-jwt dependency is declared in provided scope on this module's POM. Consumers that want JWT validation must add nimbus-jose-jwt themselves at the version of their choice. This way:

  • The core juneau-rest-server jar stays JWT-free.
  • Services that never use JWT pay zero classpath cost.
  • Services that DO use JWT pick their own nimbus version (security upgrades, CVE patches) without waiting for a Juneau release.
Security defaults

JwtTokenValidator ships with secure defaults:

  • alg: none is permanently rejected — there is no opt-in.
  • HS256 is rejected unless explicitly allowlisted via algorithms(...). Mixing HMAC and asymmetric keys in the same validator is intentionally prevented.
  • iss, aud, exp, nbf are mandatory by default. A token missing any of these is rejected.
  • Clock-skew tolerance defaults to 60s and is capped at 300s by the builder.
  • JWKS keys are cached for 5 minutes. Cache continues to serve stale keys when the JWKS endpoint is unreachable, logging a warning, so a transient network blip doesn't take down auth for the whole service.
See Also:
Since:
10.0.0