0.0.3

What's Changed

Clock-Skew Validation Enforcement

The clockSkew configuration property now enforces a hard maximum of 60 seconds.
Providing a value above this limit throws an IllegalArgumentException immediately at
configuration time — both via the builder API and via Spring Boot auto-configuration
properties — so misconfigured deployments fail fast rather than silently accepting
an unsafe tolerance.

Behaviour summary

Input	Result
null	Treated as Duration.ZERO (no skew)
0 – 60 s	Accepted and stored as-is
> 60 s	IllegalArgumentException: "clockSkew exceeds the maximum allowed value of 60 seconds"
Negative	IllegalArgumentException: "clockSkew must not be negative"

Affected classes

• TokenValidatorBuilder.clockSkew(Duration) — new MAX_CLOCK_SKEW constant (Duration.ofSeconds(60)) exposed as static final
• TokenValidatorProperties.setClockSkew(Duration) — same enforcement; MAX_CLOCK_SKEW exposed as public static final

---

Dependency Upgrades

Dependency	Previous	Updated
Spring Boot	4.0.6	4.0.7

---

Other Changes

• Update next version by @eclipse-ecsp-bot in #15
• Clockskew validation by @abhishekkumar-harman in #16
• Update DEPENDENCIES by @eclipse-ecsp-bot in #17
• Update DEPENDENCIES by @eclipse-ecsp-bot in #18

New Contributors

• @abhishekkumar-harman made their first contribution in #16

Full Changelog: 0.0.2...0.0.3

0.0.2

Bug Fixes

DefaultScopeValidator – token scopes without a configured prefix now match correctly

Affected versions: 0.0.1

Symptom: When a scope prefix was configured (e.g. vehicle:), token scopes that carried
no prefix (e.g. SelfManage) were silently dropped from the filtered set before comparison.
This caused validation to fail with: Token does not have required scopes for endpoint

Full Changelog: 0.0.1...0.0.2

0.0.1

🚀 Initial Release — Token Validator v0.0.1

Token Validator is a reusable Java library for validating JWT tokens, managing public keys, and handling validation scenarios in microservices architectures. This is the first public release of the library as part of the Eclipse ECSP platform.

---

Requirements

Requirement	Version
Java	25
Spring Boot	4.x
Spring Framework	7.x

---

What's Included

Validation Pipeline

A fully decomposed, 7-step validation pipeline where every step is a replaceable interface:

1. TokenPreprocessor — strips Bearer prefix / normalises raw input
2. TokenParser — extracts unverified header + payload; rejects JWE immediately
3. AlgorithmValidator — whitelist check; alg=none unconditionally denied
4. PublicKeyManager — O(1) cache lookup with fallback key strategy on cache miss
5. TokenSignatureValidator — cryptographic signature verification via nimbus-jose-jwt
6. TokenClaimsValidator — validates exp, nbf (with configurable clock-skew), and iss
7. ValidationHook list — composable post-validation logic executed in getOrder() precedence

Public Key Management

• Load public keys from JWKS endpoints and PEM files
• In-memory LRU cache (InMemoryPublicKeyCache) with per-issuer refresh — no TTL-based expiry
• Exponential-backoff retry (ExponentialBackoffJwksRetryStrategy) for JWKS endpoint failures
• Scheduled key refresh with configurable interval
• PublicKeyRotationEvent triggers async per-issuer refresh on demand
• DefaultFallbackKeyStrategy resolves a default key from cache or PEM on cache miss; NoFallbackStrategy fails fast
• Hot validation path never performs blocking I/O

Claims & Scope Validation

• Standard claims: exp, nbf, iss
• Optional per-issuer audience (aud) validation via AudienceValidator
• Configurable clock-skew tolerance for exp and nbf (default: zero)
• Opt-in scope validation with configurable prefix stripping and match mode (ALL / ANY)

Spring Boot Integration

• Full Spring Boot auto-configuration with @ConditionalOnMissingBean overrides at every step
• Programmatic builder API (TokenValidatorBuilder) for non-Spring usage — simplified and advanced wiring modes

---

Extension Points

Interface	Default Implementation
TokenPreprocessor	StandardTokenPreprocessor
TokenParser	StandardTokenParser
AlgorithmValidator	WhitelistAlgorithmValidator
TokenSignatureValidator	DefaultTokenSignatureValidator
TokenClaimsValidator	StandardTokenClaimsValidator
FallbackKeyStrategy	DefaultFallbackKeyStrategy
JwksRetryStrategy	ExponentialBackoffJwksRetryStrategy
PublicKeyManager	DefaultPublicKeyManager
PublicKeyCache	InMemoryPublicKeyCache

---

Installation

<dependency>
    <groupId>org.eclipse.ecsp</groupId>
    <artifactId>token-validator</artifactId>
    <version>0.0.1</version>
</dependency>

Full Changelog: https://github.com/eclipse-ecsp/token-validator/commits/0.0.1