$ show FusionAuth/fusionauth-jwt
This repository is a Java library for JSON Web Token (JWT) handling per RFC 7519. It provides comprehensive functionality for creating, signing, verifying, and decoding JWTs, supporting multiple cryptographic algorithms including HMAC (HS256/384/512), RSA (RS256/384/512, PS256/384/512), EC (ES256/384/512), and EdDSA (Ed25519/Ed448). The library also includes utilities for JSON Web Key (JWK) management, PEM encoding/decoding of keys and certificates, and ASN.1 DER parsing for low-level cryptographic operations. Architecturally, the library follows a modular structure with clear separation of concerns: core JWT operations in the `jwt` package, JWK handling in `jwks`, PEM utilities in `pem`, and DER parsing in `der`. Cryptographic operations are abstracted through `Signer` and `Verifier` interfaces, enabling the Strategy pattern for pluggable algorithm implementations. Object creation uses the Builder pattern for immutable, fluent APIs (e.g., `JWT.addClaim()`, `KeyPair.build()`). JSON processing is centralized via a configured Jackson `Mapper` with custom serializers/deserializers for Java 8+ date-time types. The design minimizes coupling, allowing components like `JWTUtils` or `HMACSigner` to be reused independently. The library is actively maintained, with recent commits (2026-07-15) and ongoing security updates (e.g., patches for CVE-2022-21449). Dependencies are managed via Maven/Savant, relying primarily on Jackson for JSON processing with optional Bouncy Castle for certain algorithms. The codebase demonstrates strong engineering practices: comprehensive unit tests cover all algorithms and edge cases, clear exception hierarchies provide specific error handling, and Java 9+ module system support is included. It serves as a robust, reusable foundation for any Java application requiring secure token-based authentication or authorization.
The LLM identified 4 files worth highlighting for reuse:
Defines the Signer interface for pluggable cryptographic signing algorithms, enabling the Strategy pattern for JWT signing. Implementations (e.g., HMACSigner, RSASigner) are isolated and depend only on standard Java crypto APIs, making them easily reusable in other projects requiring cryptographic operations.
Concrete implementation of the Signer interface for HMAC-based algorithms (HS256, HS384, HS512). It encapsulates the MAC initialization and signing logic, depending only on javax.crypto.Mac and SecretKeySpec. This component can be extracted and used in any project needing HMAC signing without pulling in the entire JWT library.
Provides static utility methods for generating cryptographic key pairs (RSA, EC, EdDSA), creating HMAC secrets, and calculating JWK thumbprints. The class has minimal internal dependencies (primarily KeyUtils for EC operations) and offers a cohesive set of functions for key material handling, making it a valuable utility for any application working with cryptographic keys.
Represents a JSON Web Key (JWK) and uses the Builder pattern for immutable object creation. It includes methods to convert from and to Java cryptographic keys (PublicKey, PrivateKey) and handles the JWK JSON structure via Jackson annotations. This component is self-contained and can be used in any project that needs to parse or create JWKs without relying on the rest of the JWT library.