Spring Oauth2 resource server with jwt token store working without verification key -


i implemented oauth2 authorization server jwt token store. have configured use private/public verfification key. here tokenconverter implementation.

@bean public tokenstore tokenstore() {     return new jwttokenstore(jwttokenenhancer()); }  @bean protected jwtaccesstokenconverter jwttokenenhancer() {     keystorekeyfactory keystorekeyfactory = new keystorekeyfactory(new classpathresource("jwt.jks"), "mysecretkey".tochararray());     jwtaccesstokenconverter converter = new jwtaccesstokenconverter();     converter.setkeypair(keystorekeyfactory.getkeypair("jwt"));     return converter; }

in resource server have added 

security:   basic:     enabled: false   oauth2:     resource:       user-info-uri: http://localhost:8050/user       jwt:         key-value:            -----begin public key-----          miibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqeaky30ipcsc+uni2xix07gu0u+pnxjyyit9/qdzvrmyxg2j+w8i1gzfkwjeuv8imrxnfy2wocwe281ck689ji2wbpd3sfxnjeyuzjthk3tsspnuefwym7yz90iqt8tpocvbpmwrnu3tk09coh2cczjvjbawtwglkm2zelk0v8npa1itzlrnhqtgydiatmpnevbyhamu2bklredmknq4paax0hhkiu78buop7aaslicybqjxp+wo3ps8514bycfdrh5bnmt/0urvmsv9ew2u2shojbau98lviaoo98rshyue3iu9rzsw0bce4xuzkkuuhborzlayhzv1ihinu6pqo+bmqidaqab           -----end public key-----

and works fine.

the problem it's still working if remove public key configuration, , can rest resource. expect won't able decode token without specifying matching public key.

how can configure authorization server token not decoded without correct public key?


Comments

Post a Comment

Popular posts from this blog

commonjs - How to write a typescript definition file for a node module that exports a function? -

consider, toml node module can use: // toml.d.ts declare module toml { export function parse(value:string):any; } declare module "toml" { export = toml; } then: /// <reference path="../../../../../defs/toml/toml.d.ts"/> import toml = require('toml'); toml.parse(...); however, node module export single function, such 'glob' ( https://github.com/isaacs/node-glob ). the node usage of module be: var glob = require("glob") glob("*.js", {}, callback(err, files) { ... }); you'd naively expect this: // glob.d.ts declare function globs(paths:string, options:any, callback:{(err:any, files:string[]):void; ...but because typescripts 'import' semantics bit strange, seems can use 'import .. = require()' statement alias modules . trying call: /// <reference path="../../../../../defs/glob/glob.d.ts"/> import blog = require('glob'); results in: error ts2072: mod
Read more

openid - Okta: Failed to get authorization code through API call -

i'm integrating okta own idp server using okta's api. i'm implementing authorization code flow following steps below: in own server, use /api/v1/authn endpoint sessiontoken. use sessiontoken obtain authorization calling endpoint: /oauth2/v1/authorize?client_id=" + clientid + "&sessiontoken=" + sessiontoken + "&response_type=code&response_mode=query&scope=openid&redirect_uri=" + redirecturl + "&state=evanyang&nonce=" it's supposed return response status code 302 , location header containing redirect url code value. however, keep getting response status code 200 , without location header, html body saying "you using unsupported browser." , "javascript disabled on browser." according api documentation: http://developer.okta.com/docs/api/resources/oidc.html#authentication-request , sessiontoken parameter sufficient this: an okta one-time sessiontoken. allows api-based
Read more

thorough guide for profiling racket code -

did googling ("racket profiling", "racket measure performance"), didn't find , there no examples in docs. did google "profile" search on htdp - no luck. (profile (f ...)) output isn't obvious other small snippets. ideally want python's python -m cprofile usage examples. when search "python profiling", both duckduckgo , google give top result: 26.4. python profilers . (although scanned quickly, seems more of reference "thorough usage guide" examples. if had else in mind, perhaps please link that?) the equivalent racket documentation be: profile: statistical profiler . a usage example: #lang racket (require profile) (profile-thunk (thunk (function-to-profile arg0 arg1) )) here (thunk e) convenience (lambda () e) . bigger example: #lang racket (module mod racket (provide f) (define (f) (for/list ([i 10000]) i))) (require (prefix-in mod: 'mod)) (define (f) (for ([i 10000
Read more