Description
This is a follow-up issue:
- originally described in Support for JWT Header TYP as "at+jwt" #9900 (which is now closed)
- solution now exists in Nimbus: https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/480/nimbusreactivejwtdecoder-with-oidcs
- https://datatracker.ietf.org/doc/rfc9068/ published since then, "at+jwt" is the new standard
Expected Behavior
Currently, if the JWT is having typ as "at+jwt", the token is rejected with message "Failed to authenticate since the JWT was invalid". Spring Security Oauth2 Resource Server with JWT as bearer token should accept typ as "at+jwt" as well.
Current Behavior
Currently, if the JWT is having typ as "at+jwt", the token is rejected with message "Failed to authenticate since the JWT was invalid".
My Authorization server is issuing JWT access token with typ as "at+jwt" as per the following draft:
https://www.rfc-editor.org/rfc/rfc9068.html
How has this issue affected you?
JWT token is rejected although this is correct as per Authorization server
What are you trying to accomplish?
Validate JWT Bearer token using Spring Security OAuth2 Resource Server capabilities.
What other alternatives have you considered?
Ugly workaround (custom JWT decoder).
Are you aware of any workarounds?
Custom JWT decoder (quite cumbersome).