Some key management issue when sign and verify JWT signature.

[KANIXB]

Hi, we are a research group to help developers build secure applications. We designed a cryptographic misuse detector on Java language(Our main concern is the secure implementation and use of Json Web Token). We found your great public repository (i.e.,
mmall-java) from Github, and a security issue detected by our detector are shown in the following. The specific security issues we found are as follows:

1. Location: Package: com.github.key.mmall.infrasucture.security; Class: RSA256PublicJWTAccessToken.class
   Security issue: not verify the public key certificate used to validate JWT signature.
   We detected that the RSA256PublicJWTAccessToken method get public key from the certificate without any verification. An attacker may use the private key corresponding to a revoked or expired or self-signed public key certificate to forge a JWT. We recommend to verify the validity of certificates and certificate chains to improve system security.
2. Location: Package: com.github.key.mmall.security.provider; Class: RSA256JWTAccessToken.class
   Security issue: using hard-coded KeyStore password.
   Hard-coded password are not security, and the attacker can attack the system by privilege escalation attacks. The security analysis can be seen in the artical : Cryptoguard: High precision detection of cryptographic vulnerabilities in massive-sized java projects. It is more secure to pass the password when running the project.

We wish the above security issues cloud truly help you to build a secure application. If you have any concern or suggestion, please feel free to contact us, we are looking forwart to your reply. Thanks.