Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Release Notes
00.79.20

00.79.20

Available on Maven Central. Etappe 3 (final) of the 00.79 line: JWE decoding, mTLS, PAR, JAR, the FIPS-profile update and the demo pass. With this, the 00.76 → 00.79 identity trilogy (JWT → OAuth2 → OIDC → hardening) was feature-complete. Additive — new types are @ExperimentalJSentinelApi; the stable surfaces are unchanged. Followed by three security-hardening ticks — 00.79.30, 00.79.40 and 00.79.41 (current release).

Release date: 2026-06-27 Previous release: 00.79.10 Maven coordinates (parent): com.svenruppert.jsentinel:jSentinel-parent:00.79.20 Full changelog: GitHub release v00.79.20

Extended OAuth2 hardening

  • JWE-decoding for ID tokens (RFC 7516) — some IdPs (e.g. Entra Conditional Access) deliver JWE(JWS(payload)). New JweDecoder SPI + JweAlgorithmAllowList (defaults() = RSA-OAEP-256 + A128/A256GCM; fips() = RSA-OAEP-256 + A256GCM); JweUnwrappingJwtValidator is a decorator (decrypt → delegate to the wrapped validator — NimbusJwtValidator untouched). The allow-list is enforced before decryption (RSA1_5 / dir downgrades rejected); a zip header is rejected and input capped at 100 KB (decompression-bomb guard); decryption is never treated as authentication.
  • mTLS client-auth (RFC 8705) — MutualTlsClientConfig + MutualTls.sslContext(...) build a TLS-1.3 SSLContext presenting the client cert; modeled outside the now-stable sealed ClientAuthentication (a TLS-layer concern). mtls_endpoint_aliases are https-enforced (a tampered discovery doc can’t redirect the cert-bearing request to plaintext).
  • PAR (RFC 9126) — PushedAuthorizationRequestClient; the browser redirect carries only client_id + request_uri (no param leak into URL/history).
  • JAR (RFC 9101) — AuthorizationRequestSigner signs the request object via the 00.77 JwtSigner (never alg:none); security claims written after the caller’s params so they can’t be overridden.

Both PAR and JAR are additive direct-API primitives — the stable AuthorizationCodeFlow is untouched (fluent .par(true) sugar is staged).

FIPS profile + demos

The fips-profile.md gains an OAuth2 / OIDC / DPoP / JWE / mTLS section (JWS RS/ES only, JWE RSA-OAEP-256 + A256GCM, DPoP RSA-2048+/P-256, TLS 1.3 everywhere) plus a new mtls-setup.md operator guide. A new 5-minute-setup-oidc.md covers OIDC RP bootstrap, one-line vendor profiles and the full hardening menu; demo-jsentinel-vaadin gains a VendorProfileOidcExample (Keycloak / Entra / Auth0 wiring, one line per IdP).

Quality

A two-pronged exit review fixed three findings before ship (JWE zip-bomb cap, mtls_endpoint_aliases https-check, accurate TLS-1.3 claim). No mocks — real RSA JWE round-trips, a real mutual-TLS handshake over SSLServerSocket, a real HttpServer PAR endpoint. Re-measured: jSentinel-jwt 75 %, jSentinel-oauth2 65 % mutation. No new module this etappe (B6 extends jSentinel-jwt / jSentinel-oauth2).

The 00.79 trilogy — done

EtappeVersionTheme
100.79.00Vendor profiles + test-oidc + Stable-API promotion
200.79.10Replay-stores + DPoP (RFC 9449) + OIDC logout-hardening
300.79.20mTLS / PAR / JAR / JWE + FIPS + demos

The 00.76 (JWT) → 00.77 (OAuth2) → 00.78 (OIDC) → 00.79 (hardening) identity stack is feature-complete on Maven Central. Next: the 00.80 high-security & operations line.

Migration

None. Additive; no source changes required. To adopt a feature, see 5-minute-setup-oidc docs. Just bump the version to 00.79.20.

00.79.1000.79.30