JWTVerifier { public Verification verify(final String rawString) throws VerificationError { Base64 decoder = new Base64(); if (StringUtils.isBlank(rawString)) { throw new VerificationError("token is blank"); } String[] pieces = rawString.split("\\."); if (pieces.length != 3) { throw new VerificationError("Illegal JWT token."); } JSONObject header, claims; long expiry; String issuer; String audience; try { header = new JSONObject(new String(decoder.decode(pieces[0]))); claims = new JSONObject(new String(decoder.decode(pieces[1]))); expiry = claims.getLong("exp"); issuer = claims.getString("iss"); audience = claims.optString("aud"); } catch (JSONException e) { throw new VerificationError("Could not parse token: " + e.getMessage()); } verifyAudience(audience); long secondsSinceExpiry = (System.currentTimeMillis() / 1000L) - expiry; if (secondsSinceExpiry >= 0) { throw new VerificationError( String.format("This token expired %d seconds ago", secondsSinceExpiry)); } if (!canVerify( header, claims, pieces[0] + "." + pieces[1], decoder.decode(pieces[2]))) { throw new VerificationError("Could not verify signature."); } return new Verification(issuer, getPrincipal(claims), getEmail(claims)); } JWTVerifier(PublicKeySource publicKeys, Properties options); Verification verify(final String rawString); static final String VERIFYAUDIENCE; static final String VERIFICATION_STRATEGY; static final String WHITELIST; }
@Test public void testVerify() throws Exception { JWTVerifier.Verification resp = verifier.verify(token); assertEquals(resp.getIssuer(), "testing issuer"); assertEquals(resp.getIdentity(), "Mr Somebody"); }
@Test public void testVerifyWSO2() throws Exception { JWTVerifier.Verification resp = verifier.verify(wso2Token); assertEquals("wso2 issuer", resp.getIssuer()); assertEquals("somebody@somewhere.org", resp.getIdentity()); }
@Test public void testNullToken() throws Exception { try { verifier.verify(null); fail(); } catch (VerificationError e) { } }
@Test public void testBadToken() throws Exception { try { verifier.verify(wrongSig); fail(); } catch (VerificationError e) { } }
@Test public void testUnknownIssuer() throws Exception { try { verifier.verify(unknown); fail(); } catch (VerificationError e) { } }
@Test public void testExpiredToken() throws Exception { try { verifier.verify(expired); fail(); } catch (VerificationError e) { } }
@Test public void testBlankToken() throws Exception { try { verifier.verify(""); fail(); } catch (VerificationError e) { } }