Sourced from io.jsonwebtoken:jjwt-api's releases.
0.12.4
This is patch release completes 10 issues, with two especially noteworthy changes, and a number of other smaller bug fixes and enhancements.
- The default Jackson deserializer will now reject duplicate JSON members by default in an attempt to be a little more strict at rejecting potentially malicious or malformed JSON. This is a default and can be overridden with a custom
ObjectMapper
if desired.- Password-based JWE encryption key algorithms (
PBES2_HS256_A128KW
,PBES2_HS384_A192KW
andPBES2_HS512_A256KW
) now enforce an upper bound (maximum) number of iterations allowed during decryption to mitigate against potential DoS attacks. Many thanks to Jingcheng Yang and Jianjun Chen from Sichuan University and Zhongguancun Lab for their work on this!A number of other issues fixed: thread-safe
ServiceLoader
usage for dynamic JSON processor lookup, Android enhancements for JSONReader
APIs, fixed Elliptic Curve field element padding, and more. Please read the 0.12.4 CHANGELOG for full details of all of these changes, and as always, project documentation is in the 0.12.4 README.Please allow 30 minutes from the time this announcement is published for the release to be available in Maven Central.
Sourced from io.jsonwebtoken:jjwt-api's changelog.
0.12.4
This patch release includes various changes listed below.
Jackson Default Parsing Behavior
This release makes two behavioral changes to JJWT's default Jackson
ObjectMapper
parsing settings:
In the interest of having stronger standards to reject potentially malformed/malicious/accidental JSON that could have undesirable effects on an application, JJWT's default
ObjectMapper
is now configured to explicitly reject/fail parsing JSON (JWT headers and/or Claims) if/when that JSON contains duplicate JSON member names.For example, now the following JSON, if parsed, would fail (be rejected) by default:
{ "hello": "world", "thisWillFail": 42, "thisWillFail": "test" }
Technically, the JWT RFCs do allow duplicate named fields as long as the last parsed member is the one used (see JWS RFC 7515, Section 4), so this is allowed. However, because JWTs often reflect security concepts, it's usually better to be defensive and reject these unexpected scenarios by default. The RFC later supports this position/preference in Section 10.12:
Ambiguous and potentially exploitable situations could arise if the JSON parser used does not enforce the uniqueness of member names or returns an unpredictable value for duplicate member names.
Finally, this is just a default, and the RFC does indeed allow duplicate member names if the last value is used, so applications that require duplicates to be allowed can simply configure their own
ObjectMapper
and use that with JJWT instead of assuming this (new) JJWT default. See [Issue #877](jwtk/jjwt#877) for more.If using JJWT's support to use Jackson to parse Custom Claim Types (for example, a Claim that should be unmarshalled into a POJO), and the JSON for that POJO contained a member that is not represented in the specified class, Jackson would fail parsing by default. Because POJOs and JSON data models can sometimes be out of sync due to different class versions, the default behavior has been changed to ignore these unknown JSON members instead of failing (i.e. the
ObjectMapper
'sDeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES
is now set tofalse
) by default.Again, if you prefer the stricter behavior of rejecting JSON with extra or unknown properties, you can configure
true
on your ownObjectMapper
instance and use that instance with theJwts.parser()
builder.Additional Changes
This release also:
... (truncated)
bf4168c
[maven-release-plugin] prepare release 0.12.45c6dec0
- Adding 0.12.4 release version referencesdd10b12
Added JWK Set documentation to README.mdJwkset doc (#912)6335381
PBES2 decryption maximum iterations (#911)2884eb7
- Updating to GitHub latest actions/checkout and actions/setup-java
script ve...628bd6f
Secret JWK k
values larger than HMAC-SHA minimums (#909)b12dabf
Fix small typos (#908)26f5dc3
Updating changelog with more information/clarity for the 0.12.4 release
(#907)f61cfa8
Test case change to reflect accurate assertion for Elliptic Curve 'd'
values ...fd619e0
disable FAIL_ON_UNKNOWN_PROPERTIES deserialization feature of Jackson by
defa...Sourced from io.jsonwebtoken:jjwt-impl's releases.
0.12.4
This is patch release completes 10 issues, with two especially noteworthy changes, and a number of other smaller bug fixes and enhancements.
- The default Jackson deserializer will now reject duplicate JSON members by default in an attempt to be a little more strict at rejecting potentially malicious or malformed JSON. This is a default and can be overridden with a custom
ObjectMapper
if desired.- Password-based JWE encryption key algorithms (
PBES2_HS256_A128KW
,PBES2_HS384_A192KW
andPBES2_HS512_A256KW
) now enforce an upper bound (maximum) number of iterations allowed during decryption to mitigate against potential DoS attacks. Many thanks to Jingcheng Yang and Jianjun Chen from Sichuan University and Zhongguancun Lab for their work on this!A number of other issues fixed: thread-safe
ServiceLoader
usage for dynamic JSON processor lookup, Android enhancements for JSONReader
APIs, fixed Elliptic Curve field element padding, and more. Please read the 0.12.4 CHANGELOG for full details of all of these changes, and as always, project documentation is in the 0.12.4 README.Please allow 30 minutes from the time this announcement is published for the release to be available in Maven Central.
Sourced from io.jsonwebtoken:jjwt-impl's changelog.
0.12.4
This patch release includes various changes listed below.
Jackson Default Parsing Behavior
This release makes two behavioral changes to JJWT's default Jackson
ObjectMapper
parsing settings:
In the interest of having stronger standards to reject potentially malformed/malicious/accidental JSON that could have undesirable effects on an application, JJWT's default
ObjectMapper
is now configured to explicitly reject/fail parsing JSON (JWT headers and/or Claims) if/when that JSON contains duplicate JSON member names.For example, now the following JSON, if parsed, would fail (be rejected) by default:
{ "hello": "world", "thisWillFail": 42, "thisWillFail": "test" }
Technically, the JWT RFCs do allow duplicate named fields as long as the last parsed member is the one used (see JWS RFC 7515, Section 4), so this is allowed. However, because JWTs often reflect security concepts, it's usually better to be defensive and reject these unexpected scenarios by default. The RFC later supports this position/preference in Section 10.12:
Ambiguous and potentially exploitable situations could arise if the JSON parser used does not enforce the uniqueness of member names or returns an unpredictable value for duplicate member names.
Finally, this is just a default, and the RFC does indeed allow duplicate member names if the last value is used, so applications that require duplicates to be allowed can simply configure their own
ObjectMapper
and use that with JJWT instead of assuming this (new) JJWT default. See [Issue #877](jwtk/jjwt#877) for more.If using JJWT's support to use Jackson to parse Custom Claim Types (for example, a Claim that should be unmarshalled into a POJO), and the JSON for that POJO contained a member that is not represented in the specified class, Jackson would fail parsing by default. Because POJOs and JSON data models can sometimes be out of sync due to different class versions, the default behavior has been changed to ignore these unknown JSON members instead of failing (i.e. the
ObjectMapper
'sDeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES
is now set tofalse
) by default.Again, if you prefer the stricter behavior of rejecting JSON with extra or unknown properties, you can configure
true
on your ownObjectMapper
instance and use that instance with theJwts.parser()
builder.Additional Changes
This release also:
... (truncated)
bf4168c
[maven-release-plugin] prepare release 0.12.45c6dec0
- Adding 0.12.4 release version referencesdd10b12
Added JWK Set documentation to README.mdJwkset doc (#912)6335381
PBES2 decryption maximum iterations (#911)2884eb7
- Updating to GitHub latest actions/checkout and actions/setup-java
script ve...628bd6f
Secret JWK k
values larger than HMAC-SHA minimums (#909)b12dabf
Fix small typos (#908)26f5dc3
Updating changelog with more information/clarity for the 0.12.4 release
(#907)f61cfa8
Test case change to reflect accurate assertion for Elliptic Curve 'd'
values ...fd619e0
disable FAIL_ON_UNKNOWN_PROPERTIES deserialization feature of Jackson by
defa...