Class Jwt

java.lang.Object

com.codename1.backend.Jwt

public final class Jwt
extends Object

HS256 JSON Web Tokens: issue one, and verify one you are handed.

Only HS256 is accepted, deliberately. A verifier that reads the algorithm out of the token it is checking is the classic JWT hole - "alg":"none" then verifies anything, and "alg":"HS256" against an RSA public key turns a public value into the signing secret. The algorithm is a property of THIS verifier, not of the token, so the header's alg is checked for agreement and never used to select anything.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	Jwt.InvalidTokenException	Thrown for any token that is not valid and current.

Method Summary

Modifier and Type	Method	Description
static String	bearer(String authorizationHeader)	Pulls the token out of an "Authorization: Bearer ..." header.
static String	issue(Map claims, byte[] secret, long ttlSeconds)	claims: the payload; "iat" and "exp" are set here and overwrite anything the caller put there
static Map	verify(String token, byte[] secret)	Returns the claims of a token that is well-formed, correctly signed and not expired.

Methods inherited from class Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

issue

public static String issue(Map claims,
 byte[] secret,
 long ttlSeconds)
                    throws IOException

• claims: the payload; "iat" and "exp" are set here and overwrite anything the caller put there
• ttlSeconds: how long the token is good for

Throws:

IOException

verify

public static Map verify(String token,
 byte[] secret)
                  throws IOException

Returns the claims of a token that is well-formed, correctly signed and not expired. Throws otherwise; there is no "valid but expired" return.

Throws:

IOException

bearer

public static String bearer(String authorizationHeader)

Pulls the token out of an "Authorization: Bearer ..." header.