Package com.nimbusds.jose.proc

Class DefaultJOSEProcessor<C extends SecurityContext>

java.lang.Object
com.nimbusds.jose.proc.DefaultJOSEProcessor<C>
All Implemented Interfaces:
ConfigurableJOSEProcessor<C>, JOSEProcessor<C>, JOSEProcessorConfiguration<C>
@ThreadSafe public class DefaultJOSEProcessor<C extends SecurityContext> extends Object implements ConfigurableJOSEProcessor<C>
Default processor of unsecured (plain), JWS and JWE objects.

Must be configured with the following:

  • To verify JWS objects: A JWS key selector using the header to suggest key candidate(s) for the signature verification. The key selection procedure is application-specific and may involve key ID lookup, a certificate check and / or some context.
  • To decrypt JWE objects: A JWE key selector using the header to suggest key candidate(s) for decryption. The key selection procedure is application-specific and may involve key ID lookup, a certificate check and / or some context.

An optional context parameter is available to facilitate passing of additional data between the caller and the underlying selector of key candidates (in both directions).

See sections 6 of RFC 7515 (JWS) and RFC 7516 (JWE) for guidelines on key selection.

This processor is configured with a standard header "typ" (type) parameter verifier which expects the JWS, JWE and plain (unsecured) objects to have the type header omitted or set to JOSE. To accept other "typ" values pass an appropriately configured JWS and / or JWE type verifier.

This processor comes with the default JWS verifier factory and the default JWE decrypter factory; they can construct verifiers / decrypters for all standard JOSE algorithms implemented by the library.

Note that for security reasons this processor is hardwired to reject unsecured (plain) JOSE objects. Override the process(PlainObject, SecurityContext) method if you need to handle unsecured JOSE objects.

To process JSON Web Tokens (JWTs) use the DefaultJWTProcessor class.

Version:
2019-10-15
Author:
Vladimir Dzhuvinov