`Jwt.id` (jti) isn't been populated with `OpenIdClaims.jti` value
See original GitHub issueDescribe the bug
Jwt.id
(jti) isn’t been populated with OpenIdClaims.jti
value
Code sample
@WithMockJwtAuth(
claims=OpenIdClaims(
sub="00000000-0000-0000-0000-000000000000", jti="00000000-0000-0000-0000-000000000000", sessionState="00000000-0000-0000-0000-000000000000",
otherClaims=Claims(stringClaims=[StringClaim(name="id_institucional", value="aa91613e-34b2-488a-94ef-09ac5bef1904")])
)
)
fun sampleTest() {}
If I check the id of Jwt, it appears null:
val authenticationJwt = authentication as JwtAuthenticationToken
val principal = authenticationJwtprincipal as Jwt
principal.id == null
Tested in
- Spring Boot 2.6.1
- com.c4-soft.springaddons:spring-security-oauth2-test-webmvc-addons:3.1.7-jdk17
- org.springframework.boot:spring-boot-starter-oauth2-resource-server (the version is based on Spring Boot version)
Expected behavior
Jwt.id
be populated based in jti
value.
Issue Analytics
- State:
- Created 2 years ago
- Comments:5 (3 by maintainers)
Top Results From Across the Web
How to use jti claim in a JWT - node.js - Stack Overflow
The "jti" (JWT ID) claim provides a unique identifier for the JWT. The identifier value MUST be assigned in a manner that ensures...
Read more >jti time not honored once JWT is used in z/OS Connect ... - IBM
The JWT jti (JWT ID) claim is usually used to prevent replay attacks by preventing the same JWT from being replayed.
Read more >Microsoft identity platform access tokens
Token identifier claim, equivalent to jti in the JWT specification. Unique, per-token identifier that is case-sensitive. rh, Opaque String, An ...
Read more >draft-ietf-oauth-access-token-jwt-12
This claim identifies the time at which the JWT access token was issued. jti REQUIRED - as defined in Section 4.1.7 of [RFC7519]....
Read more >How does JTI prevent a JWT from being replayed?
Or only when a new token is generated? The "jti" (JWT ID) claim provides a unique identifier for the JWT. The identifier value...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
@SrMouraSilva release
3.1.8
done.It usually takes about two hours for the libs to be transfered to https://repo1.maven.org/maven2/com/c4-soft/springaddons/spring-security-oauth2-test-addons/
This looks like a bug. Will have a look ASAP.