Breaking News: Grepper is joining You.com. Read the official announcement!

non repudiation with self issued and nested JWTs

Pragya Keshap answered on February 7, 2023 Popularity 1/10 Helpfulness 1/10

answer non repudiation with self issued and nested JWTs

non repudiation with self issued and nested JWTs

Comment

A signed JWT/JWS object can be additionally encrypted, thus providing integrity, authenticity, non-repudiation and confidentiality to data.

The JWT is signed with a private RSA or EC key.

The signed JWT then becomes the payload (plaintext) of a JWE object, which is encrypted with either the public key (RSA or EC) of the recipient, or with a secret key that has been shared between the two parties.

Processing a nested JWT works backwards:

The JWE object is decrypted with the appropriate key (private key for RSA or EC, or established secret key).

The extracted payload (plain text) is then parsed as a signed JWT, and verified with the issuer’s public key (RSA or EC).

static class CustomAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken> {
    public AbstractAuthenticationToken convert(Jwt jwt) {
        return new CustomAuthenticationToken(jwt);
    }
}

// ...

@Configuration
@EnableWebSecurity
public class CustomAuthenticationConverterConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .jwtAuthenticationConverter(new CustomAuthenticationConverter())
                )
            );
        return http.build();
    }
}

https://www.linkedin.com/pulse/beneffits-jwtjwsjwe-api-designs-wagner-brunca/

Popularity 1/10 Helpfulness 1/10 Language java

Source: Grepper

Tags: java nested self

Link to this answer
Share Copy Link

Contributed on Feb 07 2023

Pragya Keshap

0 Answers Avg Quality 2/10

non repudiation with self issued and nested JWTs

Contents

More Related Answers

non repudiation with self issued and nested JWTs

Grepper

Documentation

Social

Legal

Contact

Oops, You will need to install Grepper and log-in to perform this action.