Soo dejinta JWKS iyada oo loo marayo proxy ee loogu talagalay dekoodhka JWT ee firfircoon ee Spring

var transport = reactor.netty.http.client.HttpClient.create()
    .proxy(spec -> spec
        .type(reactor.netty.transport.ProxyProvider.Proxy.HTTP)
        .host("proxy.example")
        .port(8080));
var webClient = org.springframework.web.reactive.function.client.WebClient
    .builder()
    .clientConnector(new org.springframework.http.client.reactive
        .ReactorClientHttpConnector(transport))
    .build();

var decoder = org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder
    .withJwkSetUri(jwkSetUri)
    .webClient(webClient)
    .build();
decoder.setJwtValidator(org.springframework.security.oauth2.jwt.JwtValidators
    .createDefaultWithIssuer(issuer));

Isticmaal qiimaha la aamini karo ee jwkSetUri/issuer oo ku rakib dekoodhkan iyada oo loo marayo bean-ka dhabta ah ee ReactiveJwtDecoder ama habaynta cad ee server-ka kheyraadka. Abuurista isaga oo ag taal dekoodh firfircoon oo aan la beddelin ma beddelo helista furayaasha. Haddii JWKS URL-ka la aamini karo uu yahay mid dadweyne oo dhexdhexaadiyayaasha dadweynaha la ogolaaday, liiska proxy-ga HTTP wuxuu bixiyaa musharrixiinta host-ka iyo port-ka gaadiidka aan xisaabta u baahnayn.

Xaqiijiyaha la muujiyay wuxuu hayaa hubinta waqtiga caadiga ah iyo xaqiijinta issuer. Hayso shuruudaha audience iyo dhammaan xaqiijiyayaasha dheeraadka ah ee barnaamijka markaad beddesho dekoodhka.

URI fure oo la yaqaan ayaa dhaafi kara ogaanshaha si loo helo. Haddii qayb kale ay wali samaynayso ogaansho ama helitaan token, u habee dariiqa macmiilkaas si gooni ah.

Tan waxay dabooshaa xaqiijinta JWT firfircoon ee server-ka kheyraadka. Server-ka kheyraadka Servlet, gelitaanka OAuth2 iyo macaamiisha API-ga ganacsiga waxay leeyihiin koodh kale; hayso URL-ka fure ee guuldareystay iyo marxaladda baaritaanka.