Repository files navigation

📚Documentation - 🚀Getting Started - 💻API Reference 💬Feedback

• Examples - code samples for common java-jwt scenarios.
• Docs site - explore our docs site and learn more about Auth0.

This library is supported for Java LTS versions 8, 11, and 17. For issues on non-LTS versions above 8, consideration will be given on a case-by-case basis.

java-jwt is intended for server-side JVM applications. Android applications should useJWTDecode.Android.

java-jwt supports the following algorithms for both signing and verification:

Note - Support for ECDSA with curve secp256k1 and SHA-256 (ES256K) has been dropped since it has beendisabled in Java 15

⚠️Important security note: JVM has a critical vulnerability for ECDSA Algorithms -CVE-2022-21449. Please review the details of the vulnerability and update your environment.

Add the dependency via Maven:

<dependency>  <groupId>com.auth0</groupId>  <artifactId>java-jwt</artifactId>  <version>4.5.0</version></dependency>

or Gradle:

implementation'com.auth0:java-jwt:4.5.0'

UseJWT.create(), configure the claims, and then callsign(algorithm) to sign the JWT.

The example below demonstrates this using theRS256 signing algorithm:

try {Algorithmalgorithm =Algorithm.RSA256(rsaPublicKey,rsaPrivateKey);Stringtoken =JWT.create()        .withIssuer("auth0")        .sign(algorithm);}catch (JWTCreationExceptionexception){// Invalid Signing configuration / Couldn't convert Claims.}

Create aJWTVerifier passing theAlgorithm, and specify any required claim values.

The following example usesRS256 to verify the JWT.

Stringtoken ="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXUyJ9.eyJpc3MiOiJhdXRoMCJ9.AbIJTDMFc7yUa5MhvcP03nJPyCPzZtQcGEp-zWfOkEE";DecodedJWTdecodedJWT;try {Algorithmalgorithm =Algorithm.RSA256(rsaPublicKey,rsaPrivateKey);JWTVerifierverifier =JWT.require(algorithm)// specify any specific claim validations        .withIssuer("auth0")// reusable verifier instance        .build();decodedJWT =verifier.verify(token);}catch (JWTVerificationExceptionexception){// Invalid signature/claims}

If the token has an invalid signature or the Claim requirement is not met, aJWTVerificationException will be thrown.

See theexamples andJavaDocs for additional documentation.

• java-jwt JavaDocs

We appreciate feedback and contribution to this repo! Before you get started, please see the following:

• Auth0's general contribution guidelines
• Auth0's code of conduct guidelines

To provide feedback or report a bug,please raise an issue on our issue tracker.

Please do not report security vulnerabilities on the public Github issue tracker. TheResponsible Disclosure Program details the procedure for disclosing security issues.

Auth0 is an easy to implement, adaptable authentication and authorization platform. To learn more checkoutWhy Auth0?

This project is licensed under the MIT license. See the LICENSE file for more info.