Skip to content

Upgrade JJWT to 0.12.6 and update JwtService for compatibility#384

Merged
R-Sandor merged 3 commits intoFindFirst-Development:mainfrom
reetikg:update-jjwt-0.12.6
Jun 11, 2025
Merged

Upgrade JJWT to 0.12.6 and update JwtService for compatibility#384
R-Sandor merged 3 commits intoFindFirst-Development:mainfrom
reetikg:update-jjwt-0.12.6

Conversation

@reetikg
Copy link
Contributor

@reetikg reetikg commented Jun 7, 2025

Issue number: resolves #372


Checklist

  • [yes ] Code Formatter (run prettier/spotlessApply)
  • [ no] Code has unit tests? (Existing tests cover JwtService)
  • [ yes] Builds on localhost
  • [yes ] Builds/Runs in docker compose

What is the current behavior?

The project uses JJWT 0.11.5, which allows JWT signing with an RSA key using older, now-deprecated methods. It does not enforce explicit use of cryptographic key types, leading to weaker security and incompatibility with newer JJWT versions.

What is the new behavior?

->Updated JJWT dependencies to version 0.12.6 in server/build.gradle.

->Refactored JwtService:

    JWT signing now uses Jwts.builder().signWith(RsaSigner).

    JWT verification now uses Jwts.parser().verifyWith(RsaVerifier).

->Introduced use of the public RSA key explicitly with verifyWith(pubKey) to validate JWTs in compliance with JJWT 0.12.6.

->Ensures cryptographically sound JWT creation and validation, enforcing best practices and improving library compatibility.

->All tests pass successfully and the application builds and runs locally and in Docker.

Does this introduce a breaking change?

  • [ ✓ ] Yes
  • No

1.JWT consumers (any service or client verifying tokens) must update their logic to use the RSA public key to validate tokens.

2.The signing and verification process now uses the updated JJWT 0.12.6 API, which requires explicit key handling (RsaSigner for signing, verifyWith(pubKey) for verification).

3.Any system that relies on decoding or verifying JWTs (e.g., mobile apps, other backend services) must ensure:

      They use a compatible JWT library.

      They verify tokens using the provided RSA public key.

4.The token structure/signature may differ slightly under the new signing method — if consumers parse JWTs manually, validation may fail unless updated.

Other information

@R-Sandor
Copy link
Collaborator

R-Sandor commented Jun 9, 2025

@reetikg Thanks for the PR, I am going to review this shortly. Just wanted you to see I did see :)

Copy link
Collaborator

@R-Sandor R-Sandor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you 🚀
I pulled everything locally to confirm. Everything is working.

@R-Sandor R-Sandor merged commit b03057d into FindFirst-Development:main Jun 11, 2025
1 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update the jwt signing to be compliant with jjwt 0.12.6

3 participants