Fixed JWT validation according to GHSA-fjq8-896w-pv28

nimble-platform · May 20, 2021 · 12197a7 · 12197a7
1 parent ad119be
commit 12197a7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java b/utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
@@ -36,7 +36,7 @@ public Claims validateToken(String token) throws AuthenticationException {
             RsaKeyUtil rsaKeyUtil = new RsaKeyUtil();
             PublicKey publicKey = rsaKeyUtil.fromPemEncoded(keycloakPublicKey);
 
-            return (Claims) Jwts.parser().setSigningKey(publicKey).parse(token.replace("Bearer ", "")).getBody();
+            return Jwts.parser().setSigningKey(publicKey).parseJws(token.replace("Bearer ", "")).getBody();
         } catch (Exception e){
             throw new AuthenticationException(String.format("Failed to check user authorization for token: %s", token), e);
         }