Package uk.co.spudsoft.jwtvalidatorvertx

Class AbstractTokenValidationTester

java.lang.Object
uk.co.spudsoft.jwtvalidatorvertx.AbstractTokenValidationTester
Direct Known Subclasses:
TestJwtValidatorVertx
public abstract class AbstractTokenValidationTester extends Object
Required tests:
  • Invalid structure (not three dots)
  • Invalid structure (first part not base64)
  • Invalid structure (second part not base64)
  • Invalid structure (third part not base64)
  • Invalid structure (first part not JSON)
  • Invalid structure (second part not JSON)
  • Algorithm none
  • Algorithm not in acceptable list (RS256, RS384, RS512) but token otherwise valid
  • Signature invalid
  • Key not in jwks output
  • Token exp value in the past - measure acceptable leeway over < 1 hour
  • Token nbf claim in the future - measure acceptable leeway over < 1 hour
  • Token bad iss accepted - not matching preconfigured values
  • Token bad aud accepted
  • Token aud not accepted when single value despite being the aud for the service
  • Token aud not accepted when single element array despite being the aud for the service
  • Token aud not accepted when first element of array despite being the aud for the service
  • Token aud not accepted when last element of array despite being the aud for the service
  • Token sub not present
Author:
jtalbut