Add logging

I didn’t come here to rant about your code but allow one question. Is it a security feature to not implement any logging for an application?

Just today I was analyzing your “JWT signature does not match locally computed signature…” exception in my application. Rather than poking around in an unfamiliar code basis I wanted to turn up the log level for the library first. When this yielded no results I cloned this repo and ran grep -ri log * which left me totally puzzled. Exclusions for commons-logging in the POM, ok, but Logback only in test scope? I’m confused.

Btw, DefaultJwtParser#parse(java.lang.String) is an enormous complexity monster of 200+ lines 😉

[lhazlewood]

If we add logging, it will most definitely be SLF4J. That allows you to plug in any logging provider implementation you desire.

Thanks for the issue! We’ll keep this open to retain a log/list of the types of logging requested by the community until we’re ready to force a dependency on everyone.

[jansohn]

Why not use SLF4J and let the users decide whether they want logging or not?

https://www.slf4j.org/faq.html#when

EDIT: How to correctly use it: https://www.slf4j.org/manual.html#libraries