Package com.networknt.security

Class JwtVerifier

  • public class JwtVerifier
extends Object
    This is a new class that is designed as non-static to replace the JwtHelper which is a static class. The reason is to pass the framework specific security configuration so that we can eliminate the security.yml for token verification. The JwtHelper will be stay for a while for backward compatibility reason as it is a public class and users might use it in their application. The only thing that need to remember is to have both security.yml and openapi-security.yml for the security configuration and there are overlap between these two files. To use this class, create an instance by passing in the security configuration and cache the instance in your app as a field or an instance variable.
    Author:
    Steve Hu

    • Constructor Detail

    • Method Detail

      • readCertificate

        public X509Certificate readCertificate​(String filename)
                                throws Exception
        Read certificate from a file and convert it into X509Certificate object
        Parameters:
        filename - certificate file name
        Returns:
        X509Certificate object
        Throws:
        Exception - Exception while reading certificate

      • getJwtFromAuthorization

        public static String getJwtFromAuthorization​(String authorization)
        Parse the jwt token from Authorization header.
        Parameters:
        authorization - authorization header.
        Returns:
        JWT token

      • verifyJwt

        public org.jose4j.jwt.JwtClaims verifyJwt​(String jwt,
                                          boolean ignoreExpiry,
                                          boolean isToken)
                                   throws org.jose4j.jwt.consumer.InvalidJwtException,
                                          ExpiredTokenException
        This method is to keep backward compatible for those call without VerificationKeyResolver.
        Parameters:
        jwt - JWT token
        ignoreExpiry - indicate if the expiry will be ignored
        isToken - indicate if the JWT is a token
        Returns:
        JwtClaims
        Throws:
        org.jose4j.jwt.consumer.InvalidJwtException - throw when the token is invalid
        ExpiredTokenException - throw when the token is expired

      • verifyJwt

        public org.jose4j.jwt.JwtClaims verifyJwt​(String jwt,
                                          boolean ignoreExpiry,
                                          boolean isToken,
                                          BiFunction<String,​Boolean,​org.jose4j.keys.resolvers.VerificationKeyResolver> getKeyResolver)
                                   throws org.jose4j.jwt.consumer.InvalidJwtException,
                                          ExpiredTokenException
        Verify JWT token format and signature. If ignoreExpiry is true, skip expiry verification, otherwise verify the expiry before signature verification. In most cases, we need to verify the expiry of the jwt token. The only time we need to ignore expiry verification is in SPA middleware handlers which need to verify csrf token in jwt against the csrf token in the request header to renew the expired token.
        Parameters:
        jwt - String of Json web token
        ignoreExpiry - If true, don't verify if the token is expired.
        isToken - True if the jwt is an OAuth 2.0 access token
        getKeyResolver - How to get VerificationKeyResolver
        Returns:
        JwtClaims object
        Throws:
        org.jose4j.jwt.consumer.InvalidJwtException - InvalidJwtException
        ExpiredTokenException - ExpiredTokenException

      • getFingerPrints

        public List getFingerPrints()
        Get a list of certificate fingerprints for server info endpoint so that certification process in light-portal can detect if your service still use the default public key certificates provided by the light-4j framework. The default public key certificates are for dev only and should be replaced on any other environment or set bootstrapFromKeyService: true if you are using light-oauth2 so that key can be dynamically loaded.
        Returns:
        List of certificate fingerprints