jwtk / jjwt

Java JWT: JSON Web Token for Java and Android
Apache License 2.0
10.17k stars 1.32k forks source link

Custom algorithm added to Registry with a JWA-standard id DON'T replace standard algorithm implementation. #956

Open amryadam opened 2 months ago

amryadam commented 2 months ago

Describe the bug Custom algorithm instance added to NestedCollection<SecureDigestAlgorithm<?, ?>with a JWA-standard id DON'T replace (override) the JJWT standard algorithm implementation.

To Reproduce Steps to reproduce the behavior: version 0.12.5 , until version 0.12.4 not present

MacAlgorithm customMacAlgorithm;

   try {
            int minKeyBitLength = 100;
            String id = "HS512";
            String jcaName = "HmacSHA512";
            Class<?> c = Class.forName("io.jsonwebtoken.impl.security.DefaultMacAlgorithm");
            Constructor<?> ctor = c.getDeclaredConstructor(String.class, String.class, int.class);
            ctor.setAccessible(true);
            customMacAlgorithm =  (MacAlgorithm) ctor.newInstance(id, jcaName, minKeyBitLength);
        } catch (ClassNotFoundException
                | NoSuchMethodException
                | InstantiationException
                | IllegalAccessException
                | InvocationTargetException e){
            throw new RuntimeException(e);
        }
        try {
            byte[] s = SECRET_BYTE ;
            var key = new SecretKeySpec(s, "HmacSHA512");
            Claims claims = Jwts.parser()
                    .verifyWith(key)
                    .sig().add(customMacAlgorithm).and().build()
                    .parseSignedClaims(token)
                    .getPayload();
            return claims;
        } catch (Exception e) {}
  1. set break point as screenshot in class io.jsonwebtoken.impl.DefaultJwtParser

Expected behavior minKeyBitLength should be 100

Screenshots

11
lhazlewood commented 1 month ago

I'll have to do some deep digging into this since I'm certain we have test cases for overrides, so I don't know why this is happening. We're traveling this week, so we'll be able to look into it next week. Thanks for the issue!