In modern distributed systems, the need for secure, interoperable token formats has never been greater. JSON Object Signing and Encryption (JOSE) is a suite of specifications that provides a standardized way to represent claims, sign them, and encrypt them using JSON data structures. For Java developers building microservices, authentication systems, or any application requiring secure token exchange, understanding and correctly implementing JOSE—including JWT, JWS, and JWE—is essential.

What is JOSE?

JOSE (JSON Object Signing and Encryption) is a framework of specifications for securely transferring claims between parties. It consists of several interrelated standards:

Why JOSE is Essential for Java Applications

1. Interoperability: Standardized format works across different platforms and languages.
2. Stateless Authentication: JWT enables distributed authentication without server-side session storage.
3. Flexible Security: Choose between signed only (JWS) or encrypted (JWE) tokens.
4. Standard Algorithms: Well-defined cryptographic algorithms with clear security properties.
5. Claims-Based: Rich claim structure for expressing user attributes and permissions.
6. Microservices Ready: Perfect for service-to-service authentication and authorization.

Java Libraries for JOSE

1. Maven Dependencies

<dependencies> <!-- Nimbus JOSE + JWT (Most popular, actively maintained) --> <dependency> <groupId>com.nimbusds</groupId> <artifactId>nimbus-jose-jwt</artifactId> <version>9.37.3</version> </dependency> <!-- JJWT (Simple, opinionated, Java JWT library) --> <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt-api</artifactId> <version>0.12.5</version> </dependency> <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt-impl</artifactId> <version>0.12.5</version> <scope>runtime</scope> </dependency> <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt-jackson</artifactId> <version>0.12.5</version> <scope>runtime</scope> </dependency> <!-- Spring Security OAuth2 Resource Server --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-oauth2-resource-server</artifactId> <version>3.2.0</version> </dependency> <!-- Bouncy Castle for advanced algorithms --> <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcprov-jdk18on</artifactId> <version>1.78</version> </dependency> <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcpkix-jdk18on</artifactId> <version>1.78</version> </dependency> </dependencies>

JSON Web Tokens (JWT) Structure

A JWT consists of three parts separated by dots:

header.payload.signature

Header:

{ "alg": "HS256", "typ": "JWT" }

Payload (Claims):

{ "sub": "1234567890", "name": "John Doe", "iat": 1516239022, "exp": 1516242622, "roles": ["admin", "user"] }

Signature: Cryptographic signature of header + payload

JSON Web Signature (JWS) Implementation

1. Basic JWT Signing and Verification with Nimbus JOSE

import com.nimbusds.jose.*; import com.nimbusds.jose.crypto.*; import com.nimbusds.jwt.*; import java.security.SecureRandom; import java.util.*; import java.time.Instant; public class JWSExample { public static void main(String[] args) throws Exception { System.out.println("=== JWS (JSON Web Signature) Examples ===\n"); // 1. HMAC SHA-256 (Symmetric) hmacExample(); // 2. RSA SHA-256 (Asymmetric) rsaExample(); // 3. ECDSA (Elliptic Curve) ecdsaExample(); // 4. Ed25519 (Edwards-curve Digital Signature Algorithm) ed25519Example(); } public static void hmacExample() throws Exception { System.out.println("\n--- HMAC SHA-256 (HS256) ---"); // Generate a secure secret key (at least 256 bits) byte[] secret = new byte[32]; new SecureRandom().nextBytes(secret); // Create signer JWSSigner signer = new MACSigner(secret); // Build JWT claims JWTClaimsSet claimsSet = new JWTClaimsSet.Builder() .subject("alice") .issuer("https://issuer.example.com") .claim("name", "Alice Smith") .claim("roles", Arrays.asList("user", "admin")) .issueTime(new Date()) .expirationTime(Date.from(Instant.now().plusSeconds(3600))) .jwtID(UUID.randomUUID().toString()) .build(); // Create JWS object SignedJWT signedJWT = new SignedJWT( new JWSHeader(JWSAlgorithm.HS256), claimsSet ); // Sign signedJWT.sign(signer); // Serialize String token = signedJWT.serialize(); System.out.println("JWT Token: " + token); System.out.println("Token length: " + token.length() + " characters"); // Verify JWSVerifier verifier = new MACVerifier(secret); boolean verified = signedJWT.verify(verifier); System.out.println("Signature verified: " + verified); // Extract claims JWTClaimsSet extracted = signedJWT.getJWTClaimsSet(); System.out.println("Subject: " + extracted.getSubject()); System.out.println("Issuer: " + extracted.getIssuer()); System.out.println("Roles: " + extracted.getStringListClaim("roles")); } public static void rsaExample() throws Exception { System.out.println("\n--- RSA SHA-256 (RS256) ---"); // Generate RSA key pair java.security.KeyPairGenerator keyGen = java.security.KeyPairGenerator.getInstance("RSA"); keyGen.initialize(2048); java.security.KeyPair keyPair = keyGen.generateKeyPair(); // Create signer with private key JWSSigner signer = new RSASSASigner(keyPair.getPrivate()); // Build claims JWTClaimsSet claimsSet = new JWTClaimsSet.Builder() .subject("bob") .issuer("https://auth.example.com") .claim("email", "[email protected]") .issueTime(new Date()) .build(); // Sign SignedJWT signedJWT = new SignedJWT( new JWSHeader.Builder(JWSAlgorithm.RS256) .keyID("rsa-key-1") .build(), claimsSet ); signedJWT.sign(signer); String token = signedJWT.serialize(); System.out.println("RSA JWT: " + token.substring(0, 50) + "..."); // Verify with public key JWSVerifier verifier = new RSASSAVerifier((java.security.interfaces.RSAPublicKey) keyPair.getPublic()); boolean verified = signedJWT.verify(verifier); System.out.println("RSA signature verified: " + verified); } public static void ecdsaExample() throws Exception { System.out.println("\n--- ECDSA (ES256) ---"); // Generate EC key pair (P-256 curve) java.security.KeyPairGenerator keyGen = java.security.KeyPairGenerator.getInstance("EC"); keyGen.initialize(new java.security.spec.ECGenParameterSpec("secp256r1")); java.security.KeyPair keyPair = keyGen.generateKeyPair(); // Create signer JWSSigner signer = new ECDSASigner(keyPair.getPrivate()); // Build and sign JWTClaimsSet claimsSet = new JWTClaimsSet.Builder() .subject("charlie") .claim("scope", "read write") .build(); SignedJWT signedJWT = new SignedJWT( new JWSHeader(JWSAlgorithm.ES256), claimsSet ); signedJWT.sign(signer); String token = signedJWT.serialize(); System.out.println("ECDSA JWT: " + token.substring(0, 50) + "..."); // Verify JWSVerifier verifier = new ECDSAVerifier( (java.security.interfaces.ECPublicKey) keyPair.getPublic()); boolean verified = signedJWT.verify(verifier); System.out.println("ECDSA verified: " + verified); } public static void ed25519Example() throws Exception { System.out.println("\n--- Ed25519 (EdDSA) ---"); // Note: Requires Bouncy Castle java.security.Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider()); try { java.security.KeyPairGenerator keyGen = java.security.KeyPairGenerator.getInstance("Ed25519", "BC"); java.security.KeyPair keyPair = keyGen.generateKeyPair(); // Create signer JWSSigner signer = new Ed25519Signer(keyPair.getPrivate()); JWTClaimsSet claimsSet = new JWTClaimsSet.Builder() .subject("david") .build(); SignedJWT signedJWT = new SignedJWT( new JWSHeader(JWSAlgorithm.EdDSA), claimsSet ); signedJWT.sign(signer); String token = signedJWT.serialize(); System.out.println("Ed25519 JWT: " + token.substring(0, 50) + "..."); // Verify JWSVerifier verifier = new Ed25519Verifier( (java.security.PublicKey) keyPair.getPublic()); boolean verified = signedJWT.verify(verifier); System.out.println("Ed25519 verified: " + verified); } catch (Exception e) { System.out.println("Ed25519 not available: " + e.getMessage()); } } }

2. JWT with JJWT Library (Simpler API)

import io.jsonwebtoken.*; import io.jsonwebtoken.security.Keys; import javax.crypto.SecretKey; import java.security.Key; import java.util.Date; import java.util.Map; import java.util.HashMap; import java.util.concurrent.TimeUnit; public class JJWTExample { public static void main(String[] args) { System.out.println("=== JJWT Library Examples ===\n"); // 1. Symmetric signing (HS256) symmetricExample(); // 2. Asymmetric signing (RS256) asymmetricExample(); // 3. JWT parsing and validation parsingExample(); // 4. JWT with custom claims customClaimsExample(); } public static void symmetricExample() { System.out.println("\n--- HMAC Symmetric (HS256) ---"); // Generate a secure key for HS256 SecretKey key = Keys.secretKeyFor(SignatureAlgorithm.HS256); // Create JWT String jws = Jwts.builder() .subject("alice") .issuer("https://myapp.com") .issuedAt(new Date()) .expiration(new Date(System.currentTimeMillis() + 3600000)) // 1 hour .claim("name", "Alice Wonderland") .claim("roles", new String[]{"user", "admin"}) .signWith(key) .compact(); System.out.println("JWT: " + jws); System.out.println("Parts: " + jws.split("\\.").length); // Parse and verify Jws<Claims> jwsClaims = Jwts.parser() .verifyWith(key) .build() .parseSignedClaims(jws); Claims claims = jwsClaims.getPayload(); System.out.println("Subject: " + claims.getSubject()); System.out.println("Name: " + claims.get("name", String.class)); System.out.println("Roles: " + String.join(", ", claims.get("roles", String[].class))); } public static void asymmetricExample() { System.out.println("\n--- RSA Asymmetric (RS256) ---"); // Generate RSA key pair java.security.KeyPair keyPair = Keys.keyPairFor(SignatureAlgorithm.RS256); // Sign with private key String jws = Jwts.builder() .subject("bob") .issuer("auth-server") .claim("scope", "read:profile") .signWith(keyPair.getPrivate()) .compact(); System.out.println("RSA JWT: " + jws); // Verify with public key Jws<Claims> jwsClaims = Jwts.parser() .verifyWith(keyPair.getPublic()) .build() .parseSignedClaims(jws); boolean valid = jwsClaims != null; System.out.println("Signature valid: " + valid); } public static void parsingExample() { System.out.println("\n--- JWT Parsing and Validation ---"); SecretKey key = Keys.secretKeyFor(SignatureAlgorithm.HS256); // Create expired token String expiredJwt = Jwts.builder() .subject("test") .expiration(new Date(System.currentTimeMillis() - 1000)) // Already expired .signWith(key) .compact(); // Create valid token String validJwt = Jwts.builder() .subject("test") .expiration(new Date(System.currentTimeMillis() + 3600000)) .signWith(key) .compact(); // Parse valid token try { Jws<Claims> valid = Jwts.parser() .verifyWith(key) .build() .parseSignedClaims(validJwt); System.out.println("Valid token accepted"); } catch (JwtException e) { System.out.println("Valid token rejected: " + e.getMessage()); } // Parse expired token try { Jwts.parser() .verifyWith(key) .build() .parseSignedClaims(expiredJwt); System.out.println("ERROR: Expired token accepted"); } catch (ExpiredJwtException e) { System.out.println("Expired token correctly rejected: " + e.getMessage()); } } public static void customClaimsExample() { System.out.println("\n--- Custom Claims ---"); SecretKey key = Keys.secretKeyFor(SignatureAlgorithm.HS256); // Create with custom claims Map<String, Object> customClaims = new HashMap<>(); customClaims.put("tenant", "acme-corp"); customClaims.put("region", "us-east"); customClaims.put("feature_flags", new String[]{"beta", "early-access"}); String jws = Jwts.builder() .subject("charlie") .claims(customClaims) .signWith(key) .compact(); // Parse and extract Jws<Claims> parsed = Jwts.parser() .verifyWith(key) .build() .parseSignedClaims(jws); Claims claims = parsed.getPayload(); System.out.println("Tenant: " + claims.get("tenant")); System.out.println("Region: " + claims.get("region")); System.out.println("Features: " + String.join(", ", claims.get("feature_flags", String[].class))); } }

JSON Web Encryption (JWE) Implementation

JWE provides confidentiality by encrypting the payload, optionally with additional authenticated data.

1. Basic JWE with Nimbus

import com.nimbusds.jose.*; import com.nimbusds.jose.crypto.*; import com.nimbusds.jwt.*; import javax.crypto.KeyGenerator; import javax.crypto.SecretKey; import java.security.KeyPair; import java.security.KeyPairGenerator; public class JWEExample { public static void main(String[] args) throws Exception { System.out.println("=== JWE (JSON Web Encryption) Examples ===\n"); // 1. Direct encryption with AES-GCM directEncryptionExample(); // 2. Key encryption with RSA-OAEP rsaKeyEncryptionExample(); // 3. Password-based encryption passwordBasedExample(); // 4. Nested JWS + JWE (Sign then Encrypt) nestedExample(); } public static void directEncryptionExample() throws Exception { System.out.println("\n--- Direct Encryption (A256GCM) ---"); // Generate AES key for content encryption KeyGenerator keyGen = KeyGenerator.getInstance("AES"); keyGen.init(256); SecretKey aesKey = keyGen.generateKey(); // Create JWE header JWEHeader header = new JWEHeader.Builder(JWEAlgorithm.DIR, EncryptionMethod.A256GCM) .contentType("JWT") // Nested JWT .build(); // Create claims JWTClaimsSet claimsSet = new JWTClaimsSet.Builder() .subject("sensitive-data") .claim("credit_card", "4111-1111-1111-1111") .claim("cvv", "123") .expirationTime(new Date(System.currentTimeMillis() + 300000)) // 5 minutes .build(); // Create JWE Payload payload = new Payload(claimsSet.toJSONObject()); JWEObject jweObject = new JWEObject(header, payload); // Encrypt jweObject.encrypt(new DirectEncrypter(aesKey)); // Serialize String jweString = jweObject.serialize(); System.out.println("JWE Token: " + jweString); System.out.println("JWE Parts: " + jweString.split("\\.").length); // Decrypt JWEObject parsed = JWEObject.parse(jweString); parsed.decrypt(new DirectDecrypter(aesKey)); JWTClaimsSet decrypted = JWTClaimsSet.parse(parsed.getPayload().toJSONObject()); System.out.println("Decrypted subject: " + decrypted.getSubject()); System.out.println("Decrypted credit card: " + decrypted.getClaim("credit_card")); } public static void rsaKeyEncryptionExample() throws Exception { System.out.println("\n--- RSA Key Encryption (RSA-OAEP + A256GCM) ---"); // Generate RSA key pair for key encryption KeyPairGenerator rsaGen = KeyPairGenerator.getInstance("RSA"); rsaGen.initialize(2048); KeyPair rsaKeyPair = rsaGen.generateKeyPair(); // Create JWE with RSA key encryption JWEHeader header = new JWEHeader.Builder( JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256GCM) .keyID("rsa-encryption-key") .build(); JWTClaimsSet claimsSet = new JWTClaimsSet.Builder() .subject("encrypted-payload") .claim("secret", "TopSecretInformation") .build(); Payload payload = new Payload(claimsSet.toJSONObject()); JWEObject jweObject = new JWEObject(header, payload); // Encrypt with RSA public key jweObject.encrypt(new RSAEncrypter(rsaKeyPair.getPublic())); String encrypted = jweObject.serialize(); System.out.println("RSA Encrypted JWE: " + encrypted.substring(0, 60) + "..."); // Decrypt with RSA private key JWEObject parsed = JWEObject.parse(encrypted); parsed.decrypt(new RSADecrypter(rsaKeyPair.getPrivate())); JWTClaimsSet decrypted = JWTClaimsSet.parse(parsed.getPayload().toJSONObject()); System.out.println("Decrypted: " + decrypted.getClaim("secret")); } public static void passwordBasedExample() throws Exception { System.out.println("\n--- Password-Based Encryption (PBES2) ---"); String password = "user-password"; // Create header with PBES2 JWEHeader header = new JWEHeader.Builder( JWEAlgorithm.PBES2_HS256_A128KW, EncryptionMethod.A128GCM) .pbes2SaltInput(Base64URL.encode("salt".getBytes())) .pbes2Count(4096) // Iteration count .build(); JWTClaimsSet claimsSet = new JWTClaimsSet.Builder() .claim("encrypted-by", "password") .build(); Payload payload = new Payload(claimsSet.toJSONObject()); JWEObject jweObject = new JWEObject(header, payload); // Encrypt with password jweObject.encrypt(new PasswordBasedEncrypter(password, 4096)); String encrypted = jweObject.serialize(); System.out.println("Password encrypted: " + encrypted); // Decrypt with password JWEObject parsed = JWEObject.parse(encrypted); parsed.decrypt(new PasswordBasedDecrypter(password)); System.out.println("Successfully decrypted with password"); } public static void nestedExample() throws Exception { System.out.println("\n--- Nested JWS + JWE (Sign then Encrypt) ---"); // Setup keys KeyGenerator aesGen = KeyGenerator.getInstance("AES"); aesGen.init(256); SecretKey encryptionKey = aesGen.generateKey(); KeyPairGenerator rsaGen = KeyPairGenerator.getInstance("RSA"); rsaGen.initialize(2048); KeyPair signingKeyPair = rsaGen.generateKeyPair(); // Step 1: Create and sign inner JWT JWTClaimsSet claimsSet = new JWTClaimsSet.Builder() .subject("alice") .claim("data", "sensitive-information") .build(); SignedJWT signedJWT = new SignedJWT( new JWSHeader(JWSAlgorithm.RS256), claimsSet ); signedJWT.sign(new RSASSASigner(signingKeyPair.getPrivate())); // Step 2: Encrypt the signed JWT JWEHeader jweHeader = new JWEHeader.Builder( JWEAlgorithm.DIR, EncryptionMethod.A256GCM) .contentType("JWT") // Indicates nested JWT .build(); Payload payload = new Payload(signedJWT.serialize()); JWEObject jweObject = new JWEObject(jweHeader, payload); jweObject.encrypt(new DirectEncrypter(encryptionKey)); String nestedToken = jweObject.serialize(); System.out.println("Nested (Encrypted + Signed) token: " + nestedToken); // Step 3: Decrypt and verify JWEObject parsedJWE = JWEObject.parse(nestedToken); parsedJWE.decrypt(new DirectDecrypter(encryptionKey)); SignedJWT parsedSigned = SignedJWT.parse(parsedJWE.getPayload().toString()); parsedSigned.verify(new RSASSAVerifier((java.security.interfaces.RSAPublicKey) signingKeyPair.getPublic())); JWTClaimsSet extracted = parsedSigned.getJWTClaimsSet(); System.out.println("Decrypted and verified subject: " + extracted.getSubject()); } }

JSON Web Keys (JWK) Management

1. JWK Generation and Serialization

import com.nimbusds.jose.jwk.*; import com.nimbusds.jose.jwk.gen.*; import com.nimbusds.jose.jwk.source.*; import com.nimbusds.jose.proc.SecurityContext; import java.util.*; public class JWKExample { public static void main(String[] args) throws Exception { System.out.println("=== JWK (JSON Web Key) Examples ===\n"); // 1. Generate RSA JWK rsaJWKExample(); // 2. Generate EC JWK ecJWKExample(); // 3. Generate Octet (Symmetric) JWK octetJWKExample(); // 4. JWK Set (JWKS) jwksExample(); // 5. JWK Rotation keyRotationExample(); } public static void rsaJWKExample() throws Exception { System.out.println("\n--- RSA JWK ---"); // Generate RSA key pair as JWK RSAKey rsaJWK = new RSAKeyGenerator(RSAKeyLength.LEN_2048) .keyID("rsa-1") .algorithm(JWSAlgorithm.RS256) .keyUse(KeyUse.SIGNATURE) .generate(); // Get public and private JWK RSAKey publicJWK = rsaJWK.toPublicJWK(); // Convert to JSON String jsonString = rsaJWK.toJSONString(); System.out.println("RSA JWK (private): " + jsonString); System.out.println("RSA JWK (public): " + publicJWK.toJSONString()); // Parse back from JSON RSAKey parsed = RSAKey.parse(jsonString); System.out.println("Parsed key ID: " + parsed.getKeyID()); } public static void ecJWKExample() throws Exception { System.out.println("\n--- EC JWK ---"); // Generate EC key pair (P-256) ECKey ecJWK = new ECKeyGenerator(Curve.P_256) .keyID("ec-1") .keyUse(KeyUse.SIGNATURE) .algorithm(JWSAlgorithm.ES256) .generate(); System.out.println("EC JWK: " + ecJWK.toJSONString()); System.out.println("Curve: " + ecJWK.getCurve()); // Get public key ECKey publicJWK = ecJWK.toPublicJWK(); System.out.println("Public EC JWK: " + publicJWK.toJSONString()); } public static void octetJWKExample() throws Exception { System.out.println("\n--- Octet (Symmetric) JWK ---"); // Generate symmetric key for HMAC OctetSequenceKey hmacKey = new OctetSequenceKeyGenerator(256) .keyID("hmac-1") .algorithm(JWSAlgorithm.HS256) .keyUse(KeyUse.SIGNATURE) .generate(); System.out.println("HMAC JWK: " + hmacKey.toJSONString()); // Generate symmetric key for AES encryption OctetSequenceKey aesKey = new OctetSequenceKeyGenerator(256) .keyID("aes-1") .algorithm(EncryptionMethod.A256GCM.getName()) .keyUse(KeyUse.ENCRYPTION) .generate(); System.out.println("AES JWK: " + aesKey.toJSONString()); } public static void jwksExample() throws Exception { System.out.println("\n--- JWK Set (JWKS) ---"); // Create multiple keys RSAKey rsaKey = new RSAKeyGenerator(RSAKeyLength.LEN_2048) .keyID("sig-1") .algorithm(JWSAlgorithm.RS256) .keyUse(KeyUse.SIGNATURE) .generate() .toPublicJWK(); ECKey ecKey = new ECKeyGenerator(Curve.P_256) .keyID("sig-2") .algorithm(JWSAlgorithm.ES256) .keyUse(KeyUse.SIGNATURE) .generate() .toPublicJWK(); OctetSequenceKey hmacKey = new OctetSequenceKeyGenerator(256) .keyID("sig-3") .algorithm(JWSAlgorithm.HS256) .keyUse(KeyUse.SIGNATURE) .generate() .toPublicJWK(); // Create JWK set JWKSet jwkSet = new JWKSet(Arrays.asList(rsaKey, ecKey, hmacKey)); String jwksJson = jwkSet.toJSONObject(true).toJSONString(); System.out.println("JWKS: " + jwksJson); // Parse back JWKSet parsed = JWKSet.parse(jwksJson); System.out.println("Parsed key count: " + parsed.getKeys().size()); // Get key by ID JWK key = parsed.getKeyByKeyId("sig-1"); System.out.println("Found key: " + (key != null)); } public static void keyRotationExample() throws Exception { System.out.println("\n--- Key Rotation ---"); // Current active key RSAKey activeKey = new RSAKeyGenerator(RSAKeyLength.LEN_2048) .keyID("key-2024-01") .issueTime(new Date()) .build(); // Generate new key for rotation RSAKey newKey = new RSAKeyGenerator(RSAKeyLength.LEN_2048) .keyID("key-2024-02") .issueTime(new Date()) .build(); // JWKS with both keys (clients can use either) JWKSet jwkSet = new JWKSet(Arrays.asList( activeKey.toPublicJWK(), newKey.toPublicJWK() )); System.out.println("Rotation JWKS: " + jwkSet.toJSONObject(true).toJSONString()); // Simulate token signed with old key JWSHeader header = new JWSHeader.Builder(JWSAlgorithm.RS256) .keyID("key-2024-01") .build(); System.out.println("Token signed with old key (keyID: " + header.getKeyID() + ")"); // Find appropriate key for verification JWK matchingKey = jwkSet.getKeyByKeyId(header.getKeyID()); System.out.println("Found matching key: " + (matchingKey != null)); } }

Spring Boot Integration

1. Resource Server Configuration

@Configuration @EnableWebSecurity public class ResourceServerConfig { @Value("${jwt.public-key}") private String publicKeyPem; @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http .authorizeHttpRequests(authz -> authz .requestMatchers("/public/**").permitAll() .requestMatchers("/api/user").hasAuthority("SCOPE_read") .requestMatchers("/api/admin").hasAuthority("SCOPE_admin") .anyRequest().authenticated() ) .oauth2ResourceServer(oauth2 -> oauth2 .jwt(jwt -> jwt .decoder(jwtDecoder()) ) ); return http.build(); } @Bean public JwtDecoder jwtDecoder() { // Parse PEM public key try { String pem = publicKeyPem .replace("-----BEGIN PUBLIC KEY-----", "") .replace("-----END PUBLIC KEY-----", "") .replaceAll("\\s", ""); byte[] encoded = Base64.getDecoder().decode(pem); X509EncodedKeySpec keySpec = new X509EncodedKeySpec(encoded); KeyFactory keyFactory = KeyFactory.getInstance("RSA"); PublicKey publicKey = keyFactory.generatePublic(keySpec); return NimbusJwtDecoder.withPublicKey((RSAPublicKey) publicKey).build(); } catch (Exception e) { throw new RuntimeException("Failed to configure JWT decoder", e); } } }

2. Token Service Implementation

@Service public class TokenService { private final JWKSource<SecurityContext> jwkSource; private final JwtEncoder jwtEncoder; public TokenService() throws Exception { // Generate RSA key pair for signing RSAKey rsaKey = new RSAKeyGenerator(2048) .keyID(UUID.randomUUID().toString()) .algorithm(JWSAlgorithm.RS256) .generate(); this.jwkSource = new ImmutableJWKSet<>(new JWKSet(rsaKey)); this.jwtEncoder = new NimbusJwtEncoder(jwkSource); } public String generateToken(String subject, List<String> roles, Duration ttl) { Instant now = Instant.now(); JwtClaimsSet claims = JwtClaimsSet.builder() .issuer("https://auth.example.com") .subject(subject) .issuedAt(now) .expiresAt(now.plus(ttl)) .claim("roles", roles) .claim("scope", String.join(" ", roles)) .build(); JwsHeader header = JwsHeader.with(JwsAlgorithm.RS256) .keyId(jwkSource.get(new JWKSelector(new JWKMatcher.Builder() .keyType(KeyType.RSA) .keyUse(KeyUse.SIGNATURE) .build()), null) .get(0).getKeyID()) .build(); return this.jwtEncoder.encode(JwtEncoderParameters.from(header, claims)) .getTokenValue(); } @RestController @RequestMapping("/api") public static class TokenController { @Autowired private TokenService tokenService; @PostMapping("/auth/login") public ResponseEntity<Map<String, String>> login(@RequestBody LoginRequest request) { // Authenticate user (simplified) if ("user".equals(request.username()) && "pass".equals(request.password())) { String token = tokenService.generateToken( request.username(), List.of("read"), Duration.ofHours(1) ); return ResponseEntity.ok(Map.of( "access_token", token, "token_type", "Bearer", "expires_in", "3600" )); } return ResponseEntity.status(401).build(); } @GetMapping("/user/profile") @PreAuthorize("hasAuthority('SCOPE_read')") public UserProfile getProfile(JwtAuthenticationToken token) { String username = token.getToken().getSubject(); return new UserProfile(username, "[email protected]"); } } record LoginRequest(String username, String password) {} record UserProfile(String username, String email) {} }

3. Custom JWT Validator

@Component public class CustomJwtValidator { private final String issuer; private final String audience; private final JWKSet jwkSet; public CustomJwtValidator(@Value("${jwt.issuer}") String issuer, @Value("${jwt.audience}") String audience, @Value("${jwt.jwks-url}") String jwksUrl) throws Exception { this.issuer = issuer; this.audience = audience; // Load JWKS from URL this.jwkSet = JWKSet.load(new URL(jwksUrl)); } public Claims validateToken(String token) throws Exception { SignedJWT signedJWT = SignedJWT.parse(token); // Validate signature JWK jwk = jwkSet.getKeyByKeyId(signedJWT.getHeader().getKeyID()); if (jwk == null) { throw new SecurityException("Key not found"); } // Create verifier based on key type JWSVerifier verifier; if (jwk instanceof RSAKey rsaKey) { verifier = new RSASSAVerifier(rsaKey.toRSAPublicKey()); } else if (jwk instanceof ECKey ecKey) { verifier = new ECDSAVerifier(ecKey.toECPublicKey()); } else { throw new SecurityException("Unsupported key type"); } if (!signedJWT.verify(verifier)) { throw new SecurityException("Invalid signature"); } // Validate claims JWTClaimsSet claims = signedJWT.getJWTClaimsSet(); // Check expiration Date now = new Date(); if (claims.getExpirationTime() == null || claims.getExpirationTime().before(now)) { throw new SecurityException("Token expired"); } // Check issuer if (!issuer.equals(claims.getIssuer())) { throw new SecurityException("Invalid issuer"); } // Check audience if (claims.getAudience() != null && !claims.getAudience().contains(audience)) { throw new SecurityException("Invalid audience"); } return new Claims(claims); } public static class Claims { private final JWTClaimsSet claims; Claims(JWTClaimsSet claims) { this.claims = claims; } public String getSubject() { return claims.getSubject(); } public List<String> getRoles() { return claims.getStringListClaim("roles"); } public Map<String, Object> getAll() { return claims.getClaims(); } } }

Security Best Practices

1. Algorithm Selection:
   • Prefer RS256, ES256, or EdDSA over HS256 for distributed systems
   • Avoid "none" algorithm entirely
   • Use RSA-OAEP or ECDH-ES for key encryption in JWE
2. Key Management:
   • Rotate keys regularly
   • Use appropriate key sizes (RSA 2048+, EC P-256+)
   • Store private keys securely (HSM, KMS, secure vaults)
3. Token Validation:
   • Always validate signature
   • Check expiration time
   • Verify issuer and audience
   • Validate not-before time
4. Claims Protection:
   • Don't store sensitive data in JWT unless encrypted
   • Use JWE for confidential claims
   • Keep token size reasonable
5. Error Handling:
   • Don't leak details about validation failures
   • Use generic error messages
   • Log security events appropriately

Conclusion

JOSE, encompassing JWT, JWS, and JWE, provides Java developers with a comprehensive, standards-based framework for secure token handling. Whether building authentication systems, microservice authorization, or secure data exchange, these specifications offer the flexibility and security required for modern applications.

By leveraging mature Java libraries like Nimbus JOSE + JWT and JJWT, developers can implement these standards correctly while focusing on their application's specific requirements. The combination of JWS for integrity and JWE for confidentiality, along with JWK for key management, creates a complete ecosystem for secure token-based communication that's interoperable across platforms and programming languages.

Java Programming Intermediate Topics – Modifiers, Loops, Math, Methods & Projects (Related to Java Programming)

Access Modifiers in Java:
Access modifiers control how classes, variables, and methods are accessed from different parts of a program. Java provides four main access levels—public, private, protected, and default—which help protect data and control visibility in object-oriented programming.
Read more: https://macronepal.com/blog/access-modifiers-in-java-a-complete-guide/

Static Variables in Java:
Static variables belong to the class rather than individual objects. They are shared among all instances of the class and are useful for storing values that remain common across multiple objects.
Read more: https://macronepal.com/blog/static-variables-in-java-a-complete-guide/

Method Parameters in Java:
Method parameters allow values to be passed into methods so that operations can be performed using supplied data. They help make methods flexible and reusable in different parts of a program.
Read more: https://macronepal.com/blog/method-parameters-in-java-a-complete-guide/

Random Numbers in Java:
This topic explains how to generate random numbers in Java for tasks such as simulations, games, and random selections. Random numbers help create unpredictable results in programs.
Read more: https://macronepal.com/blog/random-numbers-in-java-a-complete-guide/

Math Class in Java:
The Math class provides built-in methods for performing mathematical calculations such as powers, square roots, rounding, and other advanced calculations used in Java programs.
Read more: https://macronepal.com/blog/math-class-in-java-a-complete-guide/

Boolean Operations in Java:
Boolean operations use true and false values to perform logical comparisons. They are commonly used in conditions and decision-making statements to control program flow.
Read more: https://macronepal.com/blog/boolean-operations-in-java-a-complete-guide/

Nested Loops in Java:
Nested loops are loops placed inside other loops to perform repeated operations within repeated tasks. They are useful for pattern printing, tables, and working with multi-level data.
Read more: https://macronepal.com/blog/nested-loops-in-java-a-complete-guide/

Do-While Loop in Java:
The do-while loop allows a block of code to run at least once before checking the condition. It is useful when the program must execute a task before verifying whether it should continue.
Read more: https://macronepal.com/blog/do-while-loop-in-java-a-complete-guide/

Simple Calculator Project in Java:
This project demonstrates how to create a basic calculator program using Java. It combines input handling, arithmetic operations, and conditional logic to perform simple mathematical calculations.
Read more: https://macronepal.com/blog/simple-calculator-project-in-java/