Saukar da JWKS ta wakili don na'urar buɗe JWT mai amsawa ta Spring

var transport = reactor.netty.http.client.HttpClient.create()
    .proxy(spec -> spec
        .type(reactor.netty.transport.ProxyProvider.Proxy.HTTP)
        .host("proxy.example")
        .port(8080));
var webClient = org.springframework.web.reactive.function.client.WebClient
    .builder()
    .clientConnector(new org.springframework.http.client.reactive
        .ReactorClientHttpConnector(transport))
    .build();

var decoder = org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder
    .withJwkSetUri(jwkSetUri)
    .webClient(webClient)
    .build();
decoder.setJwtValidator(org.springframework.security.oauth2.jwt.JwtValidators
    .createDefaultWithIssuer(issuer));

Yi amfani da amintattun ƙimar jwkSetUri/issuer kuma shigar da wannan na'urar buɗe ta hanyar ainihin ReactiveJwtDecoder bean ko bayyanannen saitin sabar albarkatu. Ƙirƙirar ta kusa da na'urar buɗe mai aiki da ba a canza ba ba ya canza hanyar samun maɓalli. Idan amintaccen JWKS URL na jama'a ne kuma an yarda da masu shiga tsakani na jama'a, jerin wakilan HTTP yana ba da 'yan takara don mai masaukin da tashar jiragen ruwa na jigilar da ba ta da asusu.

Mai tabbatarwa da aka nuna yana riƙe binciken lokaci na asali da tabbatar da issuer. Riƙe bukatun masu sauraro da duk ƙarin masu tabbatar da aikace-aikacen lokacin maye gurbin na'urar buɗe.

Sanannen URI na maɓalli yana tsallake ganowa don gano shi. Idan wani ɓangare har yanzu yana ganowa ko samun alama, saita hanyar wannan abokin ciniki daban.

Wannan ya shafi tabbatar da JWT mai amsawa a sabar albarkatu. Sabar albarkatu ta Servlet, shiga OAuth2 da abokan cinikin API na kasuwanci suna da wasu ƙugiya; ajiye URL ɗin maɓallin da ya kasa da matakin tare da binciken.