Repository files navigation

NoteAs part of our ongoing commitment to best security practices, we have rotated the signing keys used to sign previous releases of this SDK. As a result, new patch builds have been released using the new signing key. Please upgrade at your earliest convenience.

While this change won't affect most developers, if you have implemented a dependency signature validation step in your build process, you may notice a warning that past releases can't be verified. This is expected, and a result of the key rotation process. Updating to the latest version will resolve this for you.

📚Documentation - 🚀Getting Started - 💻API Reference 💬Feedback

• Examples - code samples for common jwks-rsa-java scenarios.
• Docs site - explore our docs site and learn more about Auth0.

Java 8 or above.

Add the dependency via Maven:

<dependency>  <groupId>com.auth0</groupId>  <artifactId>jwks-rsa</artifactId>  <version>0.22.1</version></dependency>

or Gradle:

implementation'com.auth0:jwks-rsa:0.22.1'

The JSON Web Tokens you obtain from an authorization server include akey id header parameter ("kid"), used to uniquely identify the Key used to sign the token.

Given the following JWT:

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IlJrSTVNakk1T1VZNU9EYzFOMFE0UXpNME9VWXpOa1ZHTVRKRE9VRXpRa0ZDT1RVM05qRTJSZyJ9.eyJpc3MiOiJodHRwczovL3NhbmRyaW5vLmF1dGgwLmNvbS8iLCJzdWIiOiJhdXRoMHw1NjMyNTAxZjQ2OGYwZjE3NTZmNGNhYjAiLCJhdWQiOiJQN2JhQnRTc3JmQlhPY3A5bHlsMUZEZVh0ZmFKUzRyViIsImV4cCI6MTQ2ODk2NDkyNiwiaWF0IjoxNDY4OTI4OTI2fQ.NaNeRSDCNu522u4hcVhV65plQOiGPStgSzVW4vR0liZYQBlZ_3OKqCmHXsu28NwVHW7_KfVgOz4m3BK6eMDZk50dAKf9LQzHhiG8acZLzm5bNMU3iobSAJdRhweRht544ZJkzJ-scS1fyI4gaPS5aD3SaLRYWR0Xsb6N1HU86trnbn-XSYSspNqzIUeJjduEpPwC53V8E2r1WZXbqEHwM9_BGEeNTQ8X9NqCUvbQtnylgYR3mfJRL14JsCWNFmmamgNNHAI0uAJo84mu_03I25eVuCK0VYStLPd0XFEyMVFpk48Bg9KNWLMZ7OUGTB_uv_1u19wKYtqeTbt9m1YcPMQ

Decode it using a JWT library or tool likejwt.io and extract thekid parameter from the Header claims.

{"typ":"JWT","alg":"RS256","kid":"RkI5MjI5OUY5ODc1N0Q4QzM0OUYzNkVGMTJDOUEzQkFCOTU3NjE2Rg"}

Thekid value can then be used to obtain the JWK using aJwkProvider.

Create aJWKProvider using the domain from which to fetch the JWK. The provider will use the domain to build the URLhttps:{your-domain}/.well-known/jwks.json:

JwkProviderprovider =newJwkProviderBuilder("https://samples.auth0.com/")    .build();

AJwk can be obtained using theget(String keyId) method:

Jwkjwk =provider.get("{kid of the signing key}");// throws Exception when not found or can't get one

The provider can be configured to cache JWKs to avoid unnecessary network requests, as well as only fetch the JWKs within a defined rate limit:

JwkProviderprovider =newJwkProviderBuilder("https://samples.auth0.com/")// up to 10 JWKs will be cached for up to 24 hours        .cached(10,24,TimeUnit.HOURS)// up to 10 JWKs can be retrieved within one minute        .rateLimited(10,1,TimeUnit.MINUTES)        .build();

See theexamples for additional configurations.

• jwks-rsa-java JavaDocs

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

• Auth0's general contribution guidelines
• Auth0's code of conduct guidelines

To provide feedback or report a bug,please raise an issue on our issue tracker.

Please do not report security vulnerabilities on the public Github issue tracker. TheResponsible Disclosure Program details the procedure for disclosing security issues.

Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkoutWhy Auth0?

This project is licensed under the MIT license. See the LICENSE file for more info.