Class Jwt

java.lang.Object
com.codename1.security.Jwt
public final class Jwt extends Object

JSON Web Token (RFC 7519) signing and verification.

Supported algorithms:

  • HS256, HS384, HS512 -- HMAC with SHA-2. Pure Java, available on every platform.
  • RS256, RS384, RS512 -- RSA-PKCS1-v1_5 with SHA-2. Backed by the platform's native crypto via Signature.
  • ES256, ES384, ES512 -- ECDSA with SHA-2. Backed by the platform's native crypto via Signature.
  • none -- unsigned tokens. Accepted on the signing side only when caller explicitly passes it; rejected on verification unless caller opts in via verifyAllowNoneAlgorithm.
Sign a token
Map<String, Object> claims = new HashMap<String, Object>();
claims.put("sub", "user-123");
claims.put("exp", System.currentTimeMillis() / 1000 + 3600);

String token = Jwt.signHs256(claims, "secret".getBytes("UTF-8"));
Verify and read claims
Jwt parsed = Jwt.parse(token);
if (!parsed.verifyHs256("secret".getBytes("UTF-8"))) {
    throw new SecurityException("bad signature");
}
String sub = (String) parsed.getClaim("sub");

  • Field Details

  • Method Details

    • signHs256

      public static String signHs256(Map<String,Object> claims, byte[] secret)
      Signs claims with HS256 and returns the encoded token.

    • signHs384

      public static String signHs384(Map<String,Object> claims, byte[] secret)
      Signs claims with HS384 and returns the encoded token.

    • signHs512

      public static String signHs512(Map<String,Object> claims, byte[] secret)
      Signs claims with HS512 and returns the encoded token.

    • sign

      public static String sign(Map<String,Object> claims, byte[] secret, String algorithm)
      Signs claims with the given HMAC algorithm. Use this when you want to pass the algorithm dynamically.

    • sign

      public static String sign(Map<String,Object> claims, PrivateKey privateKey, String algorithm)

      Signs claims with the given RSA or ECDSA algorithm.

      Parameters

    • signNone

      public static String signNone(Map<String,Object> claims)
      Builds an unsigned token (header {"alg":"none"}). Accepting these on the verify side is dangerous -- see verifyAllowNoneAlgorithm.

    • parse

      public static Jwt parse(String token)
      Parses an encoded JWT into a Jwt object. The signature is NOT verified -- you must call one of the verify* methods afterwards.

    • setVerifyAllowNoneAlgorithm

      public void setVerifyAllowNoneAlgorithm(boolean allow)
      When set to true, verify(PublicKey) will accept tokens whose alg header is none (i.e. unsigned). The default is false because in most JWT deployments accepting unsigned tokens is a critical security bug. Only enable this if you have very deliberately decided that you trust the transport.

    • verifyHs256

      public boolean verifyHs256(byte[] secret)
      Verifies with a shared HMAC secret. The token's alg header is read and must be one of the HS family.

    • verifyHs384

      public boolean verifyHs384(byte[] secret)
      HMAC verification with HS384.

    • verifyHs512

      public boolean verifyHs512(byte[] secret)
      HMAC verification with HS512.

    • verify

      public boolean verify(PublicKey publicKey)
      Verifies an RSA or ECDSA signature using the given public key. The algorithm must match the token's alg header (RS256/384/512 or ES256/384/512).

    • getAlgorithm

      public String getAlgorithm()
      Returns the alg field from the JWT header (e.g. "HS256").

    • getHeader

      public Map<String,Object> getHeader()
      Returns the parsed header as an unmodifiable view into the original map. Mutating it has undefined behaviour.

    • getClaims

      public Map<String,Object> getClaims()
      Returns the parsed claims (token payload) as an unmodifiable view into the original map. Mutating it has undefined behaviour.

    • getClaim

      public Object getClaim(String name)
      Returns the value of a single claim, or null if the claim is absent.

    • getSignature

      public byte[] getSignature()
      Returns the raw bytes of the signature segment as decoded from URL-safe base64. May be empty for unsigned tokens.