Backend API. Server-side code: this runs in a Codename One backend, not in the app on the device.

public final class Jwt

  1. Object
  2. Jwt

HS256 JSON Web Tokens: issue one, and verify one you are handed.

Only HS256 is accepted, deliberately. A verifier that reads the algorithm out of the token it is checking is the classic JWT hole - “alg”:“none” then verifies anything, and “alg”:“HS256” against an RSA public key turns a public value into the signing secret. The algorithm is a property of THIS verifier, not of the token, so the header’s alg is checked for agreement and never used to select anything.

Nested types

class Jwt.InvalidTokenExceptionThrown for any token that is not valid and current.

Methods

public static String issue(Map claims, byte[] secret, long ttlSeconds) throws IOException
  • claims: the payload; “iat” and “exp” are set here and overwrite anything the caller put there - ttlSeconds: how long the token is good for
public static Map verify(String token, byte[] secret) throws IOExceptionReturns the claims of a token that is well-formed, correctly signed and not expired.
public static String bearer(String authorizationHeader)Pulls the token out of an “Authorization: Bearer …” header.

Inherited methods

From Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait, clone, finalize

Method details

issue

public static String issue(Map claims, byte[] secret, long ttlSeconds) throws IOException
  • claims: the payload; “iat” and “exp” are set here and overwrite anything the caller put there
  • ttlSeconds: how long the token is good for

Throws

IOException

verify

public static Map verify(String token, byte[] secret) throws IOException
Returns the claims of a token that is well-formed, correctly signed and not expired. Throws otherwise; there is no “valid but expired” return.

Throws

IOException

bearer

public static String bearer(String authorizationHeader)
Pulls the token out of an “Authorization: Bearer …” header.