rbkgh/jose4j

The jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK). It is written in Java and relies solely on the JCA APIs for cryptography. Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..

jose4j's Issues

An issue when using this in a Spring application

Hello, I use this library in a Spring Boot application and unfortunately I've found an issue that will force me to replace this with another library.
In integreation tests, when I decode a JWT with a JwtConsumer, the HttpsJwks class makes a remote call to the issuer using the Get class, which uses a URLConnection. This prevents me from mocking that call using a Spring class such as MockRestServiceServer, because this class binds to a specific RestTemplate instance (declared as a Spring bean, usually), and will only intercept calls made using that same RestTemplate

Is there a way to manually provide the JsonWebKeys to the HttpsJwks class, or some other solution? (Doesn't seem like it by looking at that class, though)

Thank you for any help with this.

setSignature in JWS should fail when invalid characters are detected prior to running base64urldecode

Problem line: https://bitbucket.org/b_c/jose4j/src/9767aa4dd40d83aee6bbb12bc03708e9d4549dd3/src/main/java/org/jose4j/jws/JsonWebSignature.java#lines-125

rfc4648 : https://datatracker.ietf.org/doc/html/rfc4648#section-3.3
"Implementations MUST reject the encoded data if it contains characters outside the base alphabet when interpreting base-encoded data"

The base64UrlDecode currently just ignores all non base64URL supported characters.
The underlying decoder library is: https://bitbucket.org/b_c/jose4j/src/9767aa4dd40d83aee6bbb12bc03708e9d4549dd3/src/main/java/org/jose4j/base64url/internal/apache/commons/codec/binary/Base64.java#lines-4:5 which is outdated. In the newer version 1.13, it should throw an error when non-base64url characters are detected prior to decoding.

Here is a defect against the CODEC-134: https://issues.apache.org/jira/browse/CODEC-134

Expected behavior:

• in setSignature, the underlying library should check for invalid base64URL characters BEFORE attempting to decode

Alternatively, the base64urldecode provided by the Apache Commons Codec library can be switched to JDK's java.util.Base64 class which is available since Java 8 and provides a safe implementation of base64 URL decode.

Similar library for iOS

Is there similar library for iOS in swift / Objective C which has similar features of Jose4J