-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add ignore validation options and static methods for validation of claims independent to token parsing #175
Changes from 8 commits
1aef6ac
efe3c63
d004330
0f4a6c1
e974307
68ba8ff
8ebd92c
8ae456f
735934d
80758c2
a0e4b69
e4ae4c5
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,72 @@ | ||
package io.jsonwebtoken; | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
|
||
/** | ||
* Container class which contains encoded header, payload and signature parts of | ||
* the token. | ||
* | ||
* @since 0.8 | ||
*/ | ||
public class JwtParts { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This is not entirely correct. A JWT can be a JWS or JWE, and they have different numbers of 'parts' (Unsecured JWT = 2 parts, JWS = 3, JWE = 5). Whatever implementation we'd have around that needs to account for any/all 3 of these scenarios, and probably typed accordingly, e.g. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Because JWE is being implemented in the |
||
|
||
private String base64UrlEncodedHeader; | ||
private String base64UrlEncodedPayload; | ||
private String base64UrlEncodedSignature; | ||
|
||
/** | ||
* Get Base64 URL encoded header. | ||
* | ||
* @return Base64 URL encoded header as String. | ||
*/ | ||
public String getBase64UrlEncodedHeader() { | ||
return base64UrlEncodedHeader; | ||
} | ||
|
||
/** | ||
* Set Base64 URL encoded header. | ||
* | ||
* @param base64UrlEncodedHeader | ||
* Base64 URL encoded header as String. | ||
*/ | ||
public void setBase64UrlEncodedHeader(String base64UrlEncodedHeader) { | ||
this.base64UrlEncodedHeader = base64UrlEncodedHeader; | ||
} | ||
|
||
/** | ||
* Get Base64 URL encoded payload. | ||
* | ||
* @return Base64 URL encoded payload as String. | ||
*/ | ||
public String getBase64UrlEncodedPayload() { | ||
return base64UrlEncodedPayload; | ||
} | ||
|
||
/** | ||
* Set Base64 URL encoded payload. | ||
* | ||
* @param base64UrlEncodedPayload | ||
* Base64 URL encoded payload as String. | ||
*/ | ||
public void setBase64UrlEncodedPayload(String base64UrlEncodedPayload) { | ||
this.base64UrlEncodedPayload = base64UrlEncodedPayload; | ||
} | ||
|
||
/** | ||
* Get Base64 URL encoded signature. | ||
* | ||
* @return Base64 URL encoded signature as String. | ||
*/ | ||
public String getBase64UrlEncodedSignature() { | ||
return base64UrlEncodedSignature; | ||
} | ||
|
||
/** | ||
* Set Base64 URL encoded signature. | ||
* | ||
* @param base64UrlEncodedSignature | ||
* Base64 URL encoded signature as String. | ||
*/ | ||
public void setBase64UrlEncodedSignature(String base64UrlEncodedSignature) { | ||
this.base64UrlEncodedSignature = base64UrlEncodedSignature; | ||
} | ||
|
||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure we want to allow this - it is not good for a spec-compliant parser to allow avoiding mandated security rules. It's probably better to catch the exception and then ignore it if you want to - otherwise it is not obvious in code that you're ignoring security checks.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok we can remove this method. Security comes first. :)