Jwk Set Uri Nimbus Jwt Decoder builders should take SignatureAlgorithm #7270
Assignees
Labels
in: oauth2
An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)
type: enhancement
A general enhancement
Milestone
Comments
jzheaux
added
type: enhancement
jzheaux
added a commit
that referenced
this issue
Aug 17, 2019
kostya05983
pushed a commit
to kostya05983/spring-security
that referenced
this issue
Aug 26, 2019
kostya05983
pushed a commit
to kostya05983/spring-security
that referenced
this issue
Aug 26, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Until Resource Server supports decrypting JWK sets, it doesn't make sense to take algorithms that imply non-public information being sent over via the JWK Set Uri.
As such,
JwkSetUriJwtDecoderBuilderandJwkSetUriReactiveJwtDecoderBuildershould only takeSignatureAlgorithm. This can be widened later in the future as needed.The text was updated successfully, but these errors were encountered: