jose4j Remote JWK Downloads Through an HTTP Proxy

Attach a proxy-aware Get instance to HttpsJwks and keep the configured key-set instance in use for its cache and later refreshes.

jose4j's remote key-set loader has its own HTTP retrieval object. Configure that object when the application can call an API but cannot download the issuer's JSON Web Keys.

The jose4j 0.9.6 API exposes Get.setHttpProxy and HttpsJwks.setSimpleHttpGet:

org.jose4j.http.Get downloader = new org.jose4j.http.Get();
downloader.setHttpProxy(new java.net.Proxy(
    java.net.Proxy.Type.HTTP,
    new java.net.InetSocketAddress("proxy.example", 8080)));
downloader.setConnectTimeout(5000);
downloader.setReadTimeout(15000);

org.jose4j.jwk.HttpsJwks jwks = new org.jose4j.jwk.HttpsJwks(
    "https://issuer.example/keys");
jwks.setSimpleHttpGet(downloader);

Use this configured jwks object in the application's key-resolution arrangement. Creating it beside an existing resolver does not change the resolver's other instance.

Get uses URL and HttpsURLConnection. The explicit Proxy is passed to URL.openConnection(Proxy); this scopes the route to this downloader rather than requiring a new JVM-wide proxy policy. Proxy authentication, if required, is an additional transport concern. An approved publicly reachable issuer URL may use an HTTP address from the HTTP proxy list when public intermediaries are permitted and no proxy account is configured.

HttpsJwks caches keys per instance, based on cache headers and its default-cache-duration setting. Retain the instance to obtain that benefit. An already cached key can let validation continue without exercising the network, while a later retrieval or refresh still depends on the configured route.

This configures key retrieval. Token validation still needs the application's normal signature, issuer, audience and other validation policy; obtaining a JSON key set alone does not perform those checks.

Tënë sô zo