-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add ignore validation options and static methods for validation of claims independent to token parsing #175
Changes from all commits
1aef6ac
efe3c63
d004330
0f4a6c1
e974307
68ba8ff
8ebd92c
8ae456f
735934d
80758c2
a0e4b69
e4ae4c5
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -261,7 +261,27 @@ public interface JwtParser { | |
* otherwise. | ||
*/ | ||
boolean isSigned(String jwt); | ||
|
||
/** | ||
* Do not validate the {@code exp} claim when parsing the JWT. | ||
* <p> | ||
* <p>Note that this circumvents security features of JWT.</p> | ||
* | ||
* @return the parser for method chaining. | ||
* @see ExpiredJwtException | ||
*/ | ||
JwtParser ignoreExpiry(); | ||
|
||
/** | ||
* Do not validate the {@code nbf} claim when parsing the JWT. | ||
* <p> | ||
* <p>Note that this circumvents security features of JWT.</p> | ||
* | ||
* @return the parser for method chaining. | ||
* @see PrematureJwtException | ||
*/ | ||
JwtParser ignoreNotBefore(); | ||
|
||
/** | ||
* Parses the specified compact serialized JWT string based on the builder's current configuration state and | ||
* returns the resulting JWT or JWS instance. | ||
|
@@ -338,6 +358,60 @@ public interface JwtParser { | |
<T> T parse(String jwt, JwtHandler<T> handler) | ||
throws ExpiredJwtException, UnsupportedJwtException, MalformedJwtException, SignatureException, IllegalArgumentException; | ||
|
||
|
||
/** | ||
* Parses the header part of the specified compact serialized JWT string. | ||
* | ||
* <p>Note that while parsing header no validation or security check will be applied.</p> | ||
* | ||
* @param jwt the compact serialized JWT to parse | ||
* @return Deserialized {@link Header} part of specified compact JWT string. | ||
*/ | ||
Header parseHeader(String jwt); | ||
|
||
/** | ||
* Checks if the specified compact serialized JWT string is expired based on the builder's current configuration state. | ||
* <p> | ||
* <p>Note that you need this method probably only then, if the parser is configured to by pass 'expiration time' ({@code exp}) claim validation (by calling builder's {@link #ignoreExpiry()} method).</p> | ||
* | ||
* @param jwt the compact serialized JWT to check | ||
* @return {@code true} if the specified JWT compact string is expired, {@code false} otherwise. | ||
*/ | ||
boolean isExpired(String jwt); | ||
|
||
/** | ||
* Checks if the specified compact serialized JWT string is premature based on the builder's current configuration state. | ||
* <p> | ||
* <p>Note that you need this method probably only then, if the parser is configured to by pass 'not before' ({@code nbf}) claim validation (by calling builder's {@link #ignoreNotBefore()} method).</p> | ||
* | ||
* @param jwt the compact serialized JWT to check | ||
* @return {@code true} if the specified JWT compact string is premature, {@code false} otherwise. | ||
*/ | ||
boolean isPremature(String jwt); | ||
|
||
|
||
/** | ||
* Validates 'expiration time' ({@code exp}) claim of the specified compact serialized JWT string based on the builder's current configuration state. | ||
* <p> | ||
* <p>Note that you need this validation method probably only then, if the parser is configured to by pass 'expiration time' ({@code exp}) claim validation (by calling builder's {@link #ignoreExpiry()} method).</p> | ||
* | ||
* @param jwt the compact serialized JWT to check | ||
* | ||
* @throws ExpiredJwtException if the validation of 'expiration time' ({@code exp}) claim is failed. | ||
*/ | ||
void validateExpiration(String jwt); | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There could be a lot of validation scenarios - I don't feel we should represent them as individual methods on the parser. Same with There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. isExpired method is just a wrapper on validateExpiration. I explained already above in my first comment, why we need isExpired method. So in my case again we can let validateExpiration method private. But again why to remove this method? Both validateExpiration and validateNotBefore methods was in the code already, just there was a part of the huge parse method. I only moved that parts of the code into the smaller methods and made them accessible. So the decision is up to you. |
||
|
||
/** | ||
* Validates 'not before' ({@code nbf}) claim of the specified compact serialized JWT string based on the builder's current configuration state. | ||
* <p> | ||
* <p>Note that you need this validation method probably only then, if the parser is configured to by pass 'not before' ({@code nbf}) claim (by calling builder's {@link #ignoreNotBefore()} method).</p> | ||
* | ||
* @param jwt the compact serialized JWT to check | ||
* | ||
* @throws PrematureJwtException if the validation of 'not before' ({@code nbf}) claim is failed. | ||
*/ | ||
void validateNotBefore(String jwt); | ||
|
||
/** | ||
* Parses the specified compact serialized JWT string based on the builder's current configuration state and | ||
* returns | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't believe this or
isPremature
is necessary - just parse the JWT - if there is an exception, you know it isn't a valid JWT. Thoughts?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do you mean isPremature or isExpired or both? In our use case we need really first ignore the expiration validation and then separately check if the token expired or not. I don't really know, if there are other cases for isPremature out there. From my point of view, we can kick all ignoreNotBefore, isPremature and validateNotBefore methods entirely. But why not let them there, may be some one need them for a specific use case.