Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Roadmap
v00.77.00 — Delivered

v00.77.00 — Delivered

✅ Delivered — on Maven Central. OAuth2 RP shipped in 00.77.00; the current published release is 00.79.41. See the release notes and Quick Start.

Theme

jSentinel-oauth2 — OAuth2 flows from the relying-party (client) perspective. Where 00.76 lays the JWT crypto base, 00.77 brings the HTTP flows for a jSentinel-protected service to act as an OAuth2 client against an external authorization server. This is OAuth2, not OIDC — the identity layer follows in 00.78.

Delivered

  • Authorization Code + PKCE (RFC 6749 / 7636) — redirect path, single-use CSPRNG state + PKCE verifier in a StateStore, callback exchange. S256-only (plain is unrepresentable).
  • Refresh-token rotation + reuse-detection (RFC 9700 §4.13.2) — a replayed token revokes the whole family, checked before the AS call; only token hashes stored.
  • Introspection (RFC 7662, bounded SHA-256-keyed cache) and revocation (RFC 7009).
  • Client authentication — client_secret_basic / _post, none (public + PKCE), private_key_jwt and client_secret_jwt, via the new JwtSigner SPI.
  • Device Authorization Grant (RFC 8628) — with interval / slow_down back-off; a browserless demo-standalone reference.
  • New JWT signing — JwtSigner + JwtSigningKey SPIs in the core, Nimbus-backed NimbusJwtSigner in jSentinel-jwt (00.76 only validated).
  • Adapters — VaadinSessionStateStore (session-bound) + an @Route callback base; a REST OAuth2CallbackHandler that hands tokens to a consumer TokenSink.

Modules

jSentinel-oauth2 (RP core), jSentinel-oauth2-vaadin, jSentinel-oauth2-rest. Wired through the fluent .oauth2(...) bootstrap; jSentinel-dx stays free of any JOSE / HTTP-client compile dependency.

Notes

  • Additive over 00.74 / 00.75 / 00.76 — three new opt-in modules; apps that don’t call .oauth2(...) pull no new dependency.
  • All 00.77 public types ship @ExperimentalJSentinelApi (promotion no earlier than 00.79).

Next

See the Roadmap — next up is v00.78.00 — jSentinel-identity-oidc.

v00.76.00 — Deliveredv00.78.00 — Delivered