Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Roadmap
v00.76.00 — Delivered

v00.76.00 — Delivered

✅ Delivered — on Maven Central. JWT validation shipped in 00.76.00 and was hardened by 00.76.10; the current published release is 00.79.41. See the release notes and Quick Start.

Theme

jSentinel-jwt — standardized JWT handling. Before 00.76 bearer tokens were opaque strings and every resolver re-implemented signature / exp / iss / aud checks; 00.76 delivers a full, RFC-compliant JWT validation stack as an opt-in module. It is the crypto and validation base for the OAuth2 (00.77) and OIDC-RP (00.78) releases.

Delivered

  • JwtValidator SPI in jSentinel-core/jwt/api — 12 pure, Result-based, JOSE-free types (sealed JwtValidationError with kebab-case codes).
  • jSentinel-jwt module on Nimbus JOSE+JWT — NimbusJwtValidator, factory and diagnostics; the only module with a JOSE library on the classpath (the same discipline as the 00.71 crypto module).
  • JWKS client — HttpJwksClient with TTL from Cache-Control: max-age, single-flight refresh on a kid miss, a 30 s negative cache and a 1 MiB body cap (no DoS-against-the-IdP).
  • Mandatory algorithm allow-list — hard block against algorithm-confusion (alg:none, HMAC-with-asymmetric-key, alg/key-family mismatch); asymmetric-only (RS / PS / ES / EdDSA).
  • .jwt(...) fluent bootstrap — adapter-symmetric across Vaadin / REST / Standalone; the DX layer discovers the factory via ServiceLoader and never compiles against a JOSE type.
  • Integration — additive OidcAccessToken.validated + fromValidated(...), an OidcInboundTokenValidator in propagation-oidc, four JWT/JWKS event types, and a demo-rest /api/jwt/demo end-to-end against a stub IdP.

Notes

  • Additive over 00.73 / 00.74 / 00.75 — consumers without a JWT pull no new dependency; the new STRICT codes only fire when .jwt(...) is used.
  • All 00.76 public types ship @ExperimentalJSentinelApi (promotion no earlier than 00.79, after the OIDC litmus test).

Hardening tick

The 00.76 line then took a security-hardening tick — additive, no new feature or module:

  • 00.76.10 — a full evidence-based security review of all 25 library modules (14 findings fixed in-cycle, no critical / no auth-bypass), the SpotBugs / FindSecBugs gate hoisted reactor-wide into the parent pom, all 46 Dependabot alerts closed, optional typ-header validation (RFC 8725), and two PRODUCTION-mode fail-fast hardenings (non-https JWKS URI, credentialed-wildcard CORS).

Next

See the Roadmap — next up is v00.77.00 — jSentinel-oauth2.

v00.75.00 — Deliveredv00.77.00 — Delivered