Ukulandwa kwe-JWKS ngommeleli wesihumushi se-JWT esisebenzayo sase-Spring

Faka iklayenti ku-NimbusReactiveJwtDecoder futhi ugcine izihlolo ezikhona ze-issuer, i-audience namanye amathokheni lapho uyixhuma kuseva yezinsiza.

var transport = reactor.netty.http.client.HttpClient.create()
    .proxy(spec -> spec
        .type(reactor.netty.transport.ProxyProvider.Proxy.HTTP)
        .host("proxy.example")
        .port(8080));
var webClient = org.springframework.web.reactive.function.client.WebClient
    .builder()
    .clientConnector(new org.springframework.http.client.reactive
        .ReactorClientHttpConnector(transport))
    .build();

var decoder = org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder
    .withJwkSetUri(jwkSetUri)
    .webClient(webClient)
    .build();
decoder.setJwtValidator(org.springframework.security.oauth2.jwt.JwtValidators
    .createDefaultWithIssuer(issuer));

Sebenzisa amanani athembekile we-jwkSetUri/issuer futhi ufake lesi sihumushi nge-bean yangempela ye-ReactiveJwtDecoder noma ngokuhlelwa okucacile kweseva yezinsiza. Ukuyidala eduze kwesihumushi esisebenza esingashintshwanga akushintshi ukutholwa kokhiye. Uma i-JWKS URL ethembekile isesidlangalaleni futhi abaxhumanisi basemphakathini bevunyelwe, uhlu lwamaproxy e-HTTP lunikeza abazongenela i-host ne-port yokuthutha engadingi i-akhawunti.

Isiqinisekisi esibonisiwe sigcina izihlolo zesikhathi eziyisisekelo nokuqinisekiswa kwe-issuer. Gcina izidingo ze-audience nazo zonke iziqinisekisi ezengeziwe zohlelo lapho ushintsha isihumushi.

I-URI yokhiye eyaziwayo yeqa ukutholwa ukuyithola. Uma enye ingxenye isenza ukutholwa noma ukutholwa kwamathokheni, hlela umzila walelo klayenti ngokwehlukana.

Lokhu kuhlanganisa ukuqinisekiswa kwe-JWT esebenzayo kuseva yezinsiza. Iseva yezinsiza ye-Servlet, ukungena nge-OAuth2 namaklayenti e-API yebhizinisi anamanye amakhonkco; gcina i-URL yokhiye eyehlulekile nesigaba kanye nophenyo.

Izihloko ezihlobene