客服电话
APP下载
迪恩网络APP
随时随地掌握行业动态
官方微信
扫描二维码
关注迪恩网络微信公众号
开源软件名称：jwtk/jjwt开源软件地址：https://github.com/jwtk/jjwt开源编程语言：Java 55.9%开源软件介绍：
Java JWT: JSON Web Token for Java and AndroidJJWT aims to be the easiest to use and understand library for creating and verifying JSON Web Tokens (JWTs) on the JVM and Android. JJWT is a pure Java implementation based exclusively on the JWT, JWS, JWE, JWK and JWA RFC specifications and open source under the terms of the Apache 2.0 License. The library was created by Les Hazlewood and is supported and maintained by a community of contributors. We've also added some convenience extensions that are not part of the specification, such as JWS compression and claim enforcement. Table of Contents
Features
Currently Unsupported Features
These features will be implemented in a future release. Community contributions are welcome! CommunityGetting HelpIf you have trouble using JJWT, please first read the documentation on this page before asking questions. We try very hard to ensure JJWT's documentation is robust, categorized with a table of contents, and up to date for each release. QuestionsIf the documentation or the API JavaDoc isn't sufficient, and you either have usability questions or are confused about something, please ask your question here. After asking your question, you may wish to join our Slack or Gittr chat rooms, but note that they may not always be attended. You will usually have a better chance of having your question answered by asking your question here. If you believe you have found a bug or would like to suggest a feature enhancement, please create a new GitHub issue, however: Please do not create a GitHub issue to ask a question. We use GitHub Issues to track actionable work that requires changes to JJWT's design and/or codebase. If you have a usability question, instead please ask your question here, or try Slack or Gittr as described above. If a GitHub Issue is created that does not represent actionable work for JJWT's codebase, it will be promptly closed. Bugs and Feature RequestsIf you do not have a usability question and believe you have a legitimate bug or feature request, please do create a new JJWT issue. If you feel like you'd like to help fix a bug or implement the new feature yourself, please read the Contributing section next before starting any work. ContributingPull RequestsSimple Pull Requests that fix anything other than JJWT core code (documentation, JavaDoc, typos, test cases, etc) are always appreciated and have a high likelihood of being merged quickly. Please send them! However, if you want or feel the need to change JJWT's functionality or core code, please do not issue a pull request without creating a new JJWT issue and discussing your desired changes first, before you start working on it. It would be a shame to reject your earnest and genuinely appreciated pull request if it might not align with the project's goals, design expectations or planned functionality. We've sadly had to reject large PRs in the past because they were out of sync with project or design expectations - all because the PR author didn't first check in with the team first before working on a solution. So, please create a new JJWT issue first to discuss, and then we can see if (or how) a PR is warranted. Thank you! Help WantedIf you would like to help, but don't know where to start, please visit the Help Wanted Issues page and pick any of the ones there, and we'll be happy to discuss and answer questions in the issue comments. If any of those don't appeal to you, no worries! Any help you would like to offer would be appreciated based on the above caveats concerning contributing pull reqeuests. Feel free to discuss or ask questions first if you're not sure. :) What is a JSON Web Token?Don't know what a JSON Web Token is? Read on. Otherwise, jump on down to the Installation section. JWT is a means of transmitting information between two parties in a compact, verifiable form. The bits of information encoded in the body of a JWT are called JWTs can be cryptographically signed (making it a JWS) or encrypted (making it a JWE). This adds a powerful layer of verifiability to the user of JWTs. The receiver has a high degree of confidence that the JWT has not been tampered with by verifying the signature, for instance. The compact representation of a signed JWT is a string that has three parts, each separated by a Each part is Base64URL-encoded. The first part is the header, which at a minimum needs to specify the algorithm used to sign the JWT. The second part is the body. This part has all the claims of this JWT encoded in it. The final part is the signature. It's computed by passing a combination of the header and body through the algorithm specified in the header. If you pass the first two parts through a base 64 url decoder, you'll get the following (formatting added for clarity):
In this case, the information we have is that the HMAC using SHA-256 algorithm was used to sign the JWT. And, the
body has a single claim, There are a number of standard claims, called Registered Claims,
in the specification and To compute the signature, you need a secret key to sign it. We'll cover keys and algorithms later. InstallationUse your favorite Maven-compatible build tool to pull the dependencies from Maven Central. The dependencies could differ slightly if you are working with a JDK project or an Android project. JDK ProjectsIf you're building a (non-Android) JDK project, you will want to define the following dependencies: Maven<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.11.5</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>0.11.5</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId> <!-- or jjwt-gson if Gson is preferred -->
<version>0.11.5</version>
<scope>runtime</scope>
</dependency>
<!-- Uncomment this next dependency if you are using JDK 10 or earlier and you also want to use
RSASSA-PSS (PS256, PS384, PS512) algorithms. JDK 11 or later does not require it for those algorithms:
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk15on</artifactId>
<version>1.70</version>
<scope>runtime</scope>
</dependency>
-->
Gradledependencies {
compile 'io.jsonwebtoken:jjwt-api:0.11.5'
runtime 'io.jsonwebtoken:jjwt-impl:0.11.5',
// Uncomment the next line if you want to use RSASSA-PSS (PS256, PS384, PS512) algorithms:
//'org.bouncycastle:bcprov-jdk15on:1.70',
'io.jsonwebtoken:jjwt-jackson:0.11.5' // or 'io.jsonwebtoken:jjwt-gson:0.11.5' for gson
}Android ProjectsAndroid projects will want to define the following dependencies and Proguard exclusions: DependenciesAdd the dependencies to your project: dependencies {
api 'io.jsonwebtoken:jjwt-api:0.11.5'
runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.11.5'
runtimeOnly('io.jsonwebtoken:jjwt-orgjson:0.11.5') {
exclude group: 'org.json', module: 'json' //provided by Android natively
}
// Uncomment the next line if you want to use RSASSA-PSS (PS256, PS384, PS512) algorithms:
//runtimeOnly 'org.bouncycastle:bcprov-jdk15on:1.70'
}ProguardYou can use the following Android Proguard exclusion rules: Understanding JJWT DependenciesNotice the above dependency declarations all have only one compile-time dependency and the rest are declared as runtime dependencies. This is because JJWT is designed so you only depend on the APIs that are explicitly designed for you to use in your applications and all other internal implementation details - that can change without warning - are relegated to runtime-only dependencies. This is an extremely important point if you want to ensure stable JJWT usage and upgrades over time: JJWT guarantees semantic versioning compatibility for all of its artifacts except the This is done to benefit you: great care goes into curating the QuickstartMost complexity is hidden behind a convenient and readable builder-based fluent interface, great for relying on IDE auto-completion to write code quickly. Here's an example: import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.security.Keys;
import java.security.Key;
// We need a signing key, so we'll create one just for this example. Usually
// the key would be read from your application configuration instead.
Key key = Keys.secretKeyFor(SignatureAlgorithm.HS256);
String jws = Jwts.builder().setSubject("Joe").signWith(key).compact();How easy was that!? In this case, we are:
The resultant Now let's verify the JWT (you should always discard JWTs that don't match an expected signature): assert Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(jws).getBody().getSubject().equals("Joe");NOTE: Ensure you call the There are two things going on here. The You have to love code one-liners that pack a punch! But what if parsing or signature validation failed? You can catch try {
Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(compactJws);
//OK, we can trust this JWT
} catch (JwtException e) {
//don't trust the JWT!
}Signed JWTsThe JWT specification provides for the ability to cryptographically sign a JWT. Signing a JWT:
These two properties - authenticity and integrity - assure us that a JWT contains information we can trust. If a JWT fails authenticity or integrity checks, we should always reject that JWT because we can't trust it. So how is a JWT signed? Let's walk through it with some easy-to-read pseudocode:
And there you have it, the final This is called a 'JWS' - short for signed JWT. Of course, no one would want to do this manually in code, and worse, if you get anything wrong, you could cause security problems or weaknesses. As a result, JJWT was created to handle all of this for you: JJWT completely automates both the creation of JWSs as well as the parsing and verification of JWSs for you. But before we dig in to showing you how to create a JWS using JJWT, let's briefly discuss Signature Algorithms and Keys, specifically as they relate to the JWT specifications. Understanding them is critical to being able to create a JWS properly. Signature Algorithms KeysThe JWT specification identifies 12 standard signature algorithms - 3 secret key algorithms and 9 asymmetric key algorithms - identified by the following names:
These are all represented in the What's really important about these algorithms - other than their security properties - is that the JWT specification RFC 7518, Sections 3.2 through 3.5 requires (mandates) that you MUST use keys that are sufficiently strong for a chosen algorithm. This means that JJWT - a specification-compliant library - will also enforce that you use sufficiently strong keys for the algorithms you choose. If you provide a weak key for a given algorithm, JJWT will reject it and throw an exception. This is not because we want to make your life difficult, we promise! The reason why the JWT specification, and consequently JJWT, mandates key lengths is that the security model of a particular algorithm can completely break down if you don't adhere to the mandatory key properties of the algorithm, effectively having no security at all. No one wants completely insecure JWTs, right? Neither would we. So what are the requirements? HMAC-SHAJWT HMAC-SHA signature algorithms
RSAJWT RSA signature algorithms That said, in keeping with best practices and increasing key lengths for security longevity, JJWT recommends that you use:
These are only JJWT suggestions and not requirements. JJWT only enforces JWT specification requirements and for any RSA key, the requirement is the RSA key (modulus) length in bits MUST be >= 2048 bits. Elliptic CurveJWT Elliptic Curve signature algorithms
Creating Safe KeysIf you don't want to think about bit length requirements or just want to make your life easier, JJWT has
provided the Secret KeysIf you want to generate a sufficiently strong SecretKey key = Keys.secretKeyFor(SignatureAlgorithm.HS256); //or HS384 or HS512Under the hood, JJWT uses the JCA provider's If you need to save this new String secretString = Encoders.BASE64.encode(key.getEncoded());Ensure you save the resulting Asymmetric KeysIf you want to generate sufficiently strong Elliptic Curve or RSA asymmetric key pairs for use with JWT ECDSA or RSA
algorithms, use the KeyPair keyPair = Keys.keyPairFor(SignatureAlgorithm.RS256); //or RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512You use the private key ( NOTE: The |
2023-10-27
2022-08-15
2022-08-17
2022-09-23
2022-08-13
六六分期app的软件客服如何联系？不知道吗？加qq群【895510560】即可！标题：六六分期
今天小编告诉大家如何处理win10系统火狐flash插件总是崩溃的问题，可能很多用户都不知
今天小编告诉大家如何对win10系统删除桌面回收站图标进行设置，可能很多用户都不知道
今天小编告诉大家如何对win10系统电脑设置节能降温的设置方法，想必大家都遇到过需要
我们在使用xp系统的过程中,经常需要对xp系统无线网络安装向导设置进行设置，可能很多
今天小编告诉大家如何处理win7系统玩cf老是与主机连接不稳定的问题，可能很多用户都不
电脑对日常生活的重要性小编就不多说了，可是一旦碰到win7系统设置cf烟雾头的问题，很
我们在日常使用电脑的时候，有的小伙伴们可能在打开应用的时候会遇见提示应用程序无法
今天小编告诉大家如何对win7系统打开vcf文件进行设置，可能很多用户都不知道怎么对win
今天小编告诉大家如何对win10系统s4开启USB调试模式进行设置，可能很多用户都不知道怎
请发表评论