Skip to content

0.0.1

Choose a tag to compare

View all tags
@abhishekkumar-harman abhishekkumar-harman released this 01 Jun 07:15
0.0.1
f31123e

🚀 Initial Release — Token Validator v0.0.1

Token Validator is a reusable Java library for validating JWT tokens, managing public keys, and handling validation scenarios in microservices architectures. This is the first public release of the library as part of the Eclipse ECSP platform.

Requirements

Requirement Version
Java 25
Spring Boot 4.x
Spring Framework 7.x

What's Included

Validation Pipeline

A fully decomposed, 7-step validation pipeline where every step is a replaceable interface:

  1. TokenPreprocessor — strips Bearer prefix / normalises raw input
  2. TokenParser — extracts unverified header + payload; rejects JWE immediately
  3. AlgorithmValidator — whitelist check; alg=none unconditionally denied
  4. PublicKeyManager — O(1) cache lookup with fallback key strategy on cache miss
  5. TokenSignatureValidator — cryptographic signature verification via nimbus-jose-jwt
  6. TokenClaimsValidator — validates exp, nbf (with configurable clock-skew), and iss
  7. ValidationHook list — composable post-validation logic executed in getOrder() precedence

Public Key Management

  • Load public keys from JWKS endpoints and PEM files
  • In-memory LRU cache (InMemoryPublicKeyCache) with per-issuer refresh — no TTL-based expiry
  • Exponential-backoff retry (ExponentialBackoffJwksRetryStrategy) for JWKS endpoint failures
  • Scheduled key refresh with configurable interval
  • PublicKeyRotationEvent triggers async per-issuer refresh on demand
  • DefaultFallbackKeyStrategy resolves a default key from cache or PEM on cache miss; NoFallbackStrategy fails fast
  • Hot validation path never performs blocking I/O

Claims & Scope Validation

  • Standard claims: exp, nbf, iss
  • Optional per-issuer audience (aud) validation via AudienceValidator
  • Configurable clock-skew tolerance for exp and nbf (default: zero)
  • Opt-in scope validation with configurable prefix stripping and match mode (ALL / ANY)

Spring Boot Integration

  • Full Spring Boot auto-configuration with @ConditionalOnMissingBean overrides at every step
  • Programmatic builder API (TokenValidatorBuilder) for non-Spring usage — simplified and advanced wiring modes

Extension Points

Interface Default Implementation
TokenPreprocessor StandardTokenPreprocessor
TokenParser StandardTokenParser
AlgorithmValidator WhitelistAlgorithmValidator
TokenSignatureValidator DefaultTokenSignatureValidator
TokenClaimsValidator StandardTokenClaimsValidator
FallbackKeyStrategy DefaultFallbackKeyStrategy
JwksRetryStrategy ExponentialBackoffJwksRetryStrategy
PublicKeyManager DefaultPublicKeyManager
PublicKeyCache InMemoryPublicKeyCache

Installation

<dependency>
    <groupId>org.eclipse.ecsp</groupId>
    <artifactId>token-validator</artifactId>
    <version>0.0.1</version>
</dependency>

Full Changelog: https://github.com/eclipse-ecsp/token-validator/commits/0.0.1

Assets 2
Loading