Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Roadmap
v00.79.00 — Delivered

v00.79.00 — Delivered

✅ Delivered — on Maven Central. Etappe 1 shipped in 00.79.00; the 00.79 line completed through Etappe 2 + 3 and then took three security-hardening ticks — the current published release is 00.79.41. See the release notes and Quick Start.

Theme

The hardening & interop release of the 00.76–00.78 JWT / OAuth2 / OIDC trilogy — making the package production-proof against real identity providers and promoting the stable API. With this, jSentinel is on par with the Quarkus oidc extension, Spring Security’s OAuth2-client and the Auth0 Java SDKs.

Delivered (Etappe 1)

  • Stable-API promotion — 47 mature JWT / OAuth2 / OIDC types lose @ExperimentalJSentinelApi and become stable API after three minor versions of soak time; a reflection guard test locks it.
  • Vendor profiles — six opt-in modules (Keycloak, Entra ID, Auth0, Okta, Google, GitHub); one line .oidc(o -> o.vendor(KeycloakProfile.INSTANCE)) instead of wiring each mapper. Every mapper reads only the signed ID-token claims and is type-confusion-guarded.
  • jSentinel-test-oidc — a real JDK HttpServer OIDC provider stub (StubIdentityProvider) + MockClock, so an RP runs its actual pipeline with no mocks.

Etappe 2 + 3 — delivered

  • 00.79.10 (Etappe 2) — replay-stores (JtiStore / NonceStore), DPoP sender-constrained tokens (RFC 9449, new jSentinel-dpop module), and OIDC back-/front-channel logout hardening.
  • 00.79.20 (Etappe 3, final) — JWE decoding (RFC 7516), mTLS (RFC 8705), PAR (RFC 9126), JAR (RFC 9101), the FIPS profile update and the demo/docs pass.

With Etappe 3 the 00.76 → 00.79 identity trilogy (JWT → OAuth2 → OIDC → hardening) was feature-complete. VendorProfile + the 00.79 types stay @ExperimentalJSentinelApi (own soak window).

Security-hardening ticks

Three consecutive audits, 60 findings closed, no new module across any of them:

  • 00.79.30 — closed all 28 findings of the 2026-07-02 source-review security audit (0 Critical, 0 High): secure-by-default session-id rotation, drift-triggered subject eviction, fail-closed empty-constraint evaluators, JWT/OIDC/DPoP spec-fidelity fixes (JWKS throttling, https-enforced trust root, crit-header rejection, back-channel-logout replay protection on by default), and corrected over-claimed JavaDoc guarantees.
  • 00.79.40 — 10 findings from a fresh audit, plus the headline feature: opt-in deny-by-default authorization (JS-SEC-024 — an un-annotated route is denied unless marked @PublicRoute; backward-compatible, off by default). A second, workflow-backed exit review found and fixed 10 further interaction findings (RF01–RF10).
  • 00.79.41 — 21 findings (1 Medium, 16 Low, 3 Info), themed around consistency drift: the GitHub identity mapper anchored to the immutable account id, the OIDC nonce/CSRF defence made reachable through handleCallback, annotation inheritance across class hierarchies, and three new shared homes (CapacityBound, LogFieldScrubber, JoseLimits) so hardening patterns can’t drift again.

Next

See the Roadmap — next up is v00.80.00 — High-security & operations.

v00.78.00 — Deliveredv00.80.00 — Planned