title: Accessing a Spring OAuth 2 JWT payload inside the Resource Server controller?
body: <p>I'm going through <a href="http://www.baeldung.com/spring-security-oauth-jwt" rel="noreferrer">this tutorial</a> on how to setup spring boot oauth with jwt.  It covers decoding the JWT token using Angular, but how do we decode it and get access to custom claims inside the Resource Server controller? </p>
  
  <p>For example with JJWT it can be done like this (<a href="https://stormpath.com/blog/token-auth-for-java" rel="noreferrer">Based on this article</a>): </p>
  
  <pre><code>    String subject = "HACKER";
      try {
          Jws jwtClaims = 
              Jwts.parser().setSigningKey(key).parseClaimsJws(jwt);
  
          subject = claims.getBody().getSubject();
  
          //OK, we can trust this JWT
  
      } catch (SignatureException e) {
  
          //don't trust the JWT!
      }
  </code></pre>
  
  <p>And Spring has a <a href="https://docs.spring.io/spring-security/oauth/apidocs/org/springframework/security/oauth2/provider/token/store/JwtAccessTokenConverter.html#decode(java.lang.String)" rel="noreferrer">JWTAccessTokenConverter.decode()</a> method, but the javadoc is lacking, and it is protected.</p>