JWT Filter Chain Validation

JWT Filter-Chain Validation

Decoder tests show how a decoder handles claims. They do not prove that the configured HTTP security chain rejects a token before protected application code runs.

Exercise the production boundary

Use synthetic signed bearer tokens with test keys and send requests through the configured bearer-token filter chain. For each case, assert both the HTTP result and whether the protected controller or downstream operation ran.

Cover valid tokens and controlled invalid cases for issuer, expiration, signature, required client identifier, and other claims required by the issuer contract. Add missing-claim cases where policy requires the claim. Assert a successful control alongside each denial case.

Do not use a mock security context as evidence of bearer-token validation. Keep decoder tests as a complementary layer, not a substitute for HTTP-boundary tests.

Treat audience as an issuer-contract decision

In the reviewed Waste Plus configuration, validators check issuer, signature, time claims, and client_id. The legacy filter-chain test explicitly shows that a wrong audience reaches the protected controller. The backend filter-chain test does not assert wrong-audience rejection. The evidence therefore does not support a claim that both services enforce audience.

Some access-token contracts use client_id rather than aud. Confirm the actual issuer's token semantics and the application's policy before adding audience validation or treating a missing audience as a defect.

Bound the result

Synthetic-key tests establish local behavior for the configured test properties. They do not prove production issuer values, deployed JWKS reachability, key rotation, or the handling of real identity-provider tokens. Verify those deployment properties separately without using production credentials in test artifacts.

Evidence sources

• backend/src/main/java/ca/bc/gov/nrs/hrs/security/Oauth2SecurityCustomizer.java
• legacy/src/main/java/ca/bc/gov/nrs/hrs/security/Oauth2SecurityCustomizer.java
• backend/src/test/java/ca/bc/gov/nrs/hrs/security/JwtBearerFilterChainSecurityTest.java
• legacy/src/test/java/ca/bc/gov/nrs/hrs/security/JwtBearerFilterChainSecurityTest.java
• backend/src/test/java/ca/bc/gov/nrs/hrs/security/JwtValidationSecurityTest.java
• legacy/src/test/java/ca/bc/gov/nrs/hrs/security/JwtValidationSecurityTest.java
• final/security-coverage-test-plan-2026-10-05.md