-
Notifications
You must be signed in to change notification settings - Fork 899
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support JWT decoding and validation #25
Comments
Hi @iainmcgin, I'd like to ever so humbly suggest that jose4j be considered for JWT decoding and validation in AppAuth . It's an open source JWT/JOSE library in Java that has extensive support for consuming and validating JWTs including being able to dynamically obtain public keys from an HTTPS endpoint like Connect's |
jose4j looks like a good choice Brian, thanks for the suggestion! The solution for this issue may actually just be documentation rather than code, pointing developers at other libraries (such as yours) that can perform this task rather than baking it in to AppAuth itself. We'd like to keep the dependencies of AppAuth as minimal as possible. |
#163 has some code for this, so I'll need to evaluate that against adding a dependency on jose4j. Looks like jose4j 0.5.5 is ~250KB, which is almost twice as big as AppAuth itself (currently ~120KB). It may still be better to leave token validation to code outwith the library. |
Partially fixed by #385 - we will need to put in some extra work to expose the new IdToken class as part of the public API. Right now it only holds the fields that are interesting for validation and discards the rest; storing the currently discarded claims as an "additionalClaims" map would be consistent with how we handle authorization requests etc. |
Is IdToken available in latest release? (0.7.1) |
Hi @iainmcgin , Do we have any way to do it in AppAuth? |
Our codebase was relying on a separate library to extract this information. I just abandoned this library as it contained a bug, and I found it an extensive additional dependency just to do some JSON parsing which I now do as follows:
But, I'd prefer to replace this with the |
@Whathecode, please, add imports. What minimal SDK does it require? |
To access the claims you can do
See #759 |
Support validating JWTs and extracting their claims as a map. This will require the ability to either dynamically use the
jwks_uri
keys provided by the provider's discovery document, or a set of acceptable keys provided by the developer.The text was updated successfully, but these errors were encountered: