Deprecate JwtParserBuilder#setSigningKey(String)

Hello. I noticed the code:

   @Deprecated
   JwtBuilder signWith(SignatureAlgorithm alg, String base64EncodedSecretKey) throws InvalidKeyException;

in the doc, this api will be removed in 1.0 realease, and recommend user to use JwtBuilder signWith(Key key, SignatureAlgorithm alg) throws InvalidKeyException; to replace the old api.

so we need to buid the key as follow: SecretKey secretKey = Keys.hmacShaKeyFor(Decoders.BASE64.decode(base64EncodedSecretKey));

but the code JwtParserBuilder setSigningKey(String base64EncodedSecretKey); doesn’t deprecated. it will transfer string to base64 byte array by framework. if user use Keys.hmacShaKeyFor(byte[] bytes), but the byte[] not decoded by base64, the error will occur.

[mrts]

Hi @lhazlewood ! Thank you, it definitely does help! Can I vote for @FunctionalInterface for the upcoming VerificationKeyResolver(s) so that lambdas can be used?

It would be awesome if I could write something along the lines of the following:

var parser = Jwts.parserBuilder()
                 .setVerificationKeyResolver((header, claims) ->
                                                 parseCertificate(header.get("x5c")).getPublicKey())
                 .build();
parser.parseClaimsJws(jwt);

[mrts]

Slightly unrelated to this issue, but @mrts, when using “x5c” for signature validation you have to verify the ceritificate chain for that certificate, as mentioned in RFC 7515 you linked:

Thanks for bringing this up, absolutely!

Here’s how we do it in the Web eID project: link.