diff --git a/docs/header_names/allowed_framework_names.adoc b/docs/header_names/allowed_framework_names.adoc index ce1b26fd00d..b5458e8e8af 100644 --- a/docs/header_names/allowed_framework_names.adoc +++ b/docs/header_names/allowed_framework_names.adoc @@ -50,6 +50,7 @@ * Spring Data Redis * SQLCipher * Thymeleaf +* Nimbus // JS * Flow.js * Node.js diff --git a/rules/S5659/java/how-to-fix-it/nimbus.adoc b/rules/S5659/java/how-to-fix-it/nimbus.adoc new file mode 100644 index 00000000000..a8c3e37bab2 --- /dev/null +++ b/rules/S5659/java/how-to-fix-it/nimbus.adoc @@ -0,0 +1,63 @@ +== How to fix it in Nimbus + +=== Code examples + +include::../../common/fix/code-rationale.adoc[] + +==== Noncompliant code example + +[source,java,diff-id=21,diff-type=noncompliant] +---- +import com.nimbusds.jwt.PlainJWT; + +public void encode(JWTClaimsSet claimsSet) { + PlainJWT jwt = new PlainJWT(claimsSet); // Noncompliant +} +---- + +[source,java,diff-id=22,diff-type=noncompliant] +---- +import com.nimbusds.jwt.PlainJWT; + +public void decode(String jwtString) { + PlainJWT jwt = PlainJWT.parse(jwtString); // Noncompliant +} +---- + +==== Compliant solution + +[source,java,diff-id=21,diff-type=compliant] +---- +import com.nimbusds.jwt.SignedJWT; + +public void encode(JWTClaimsSet claimsSet) { + SignedJWT jwt = new SignedJWT(new JWSHeader(JWSAlgorithm.HS256), claimsSet); + jwt.sign(new MACSigner(sharedSecret)); +} +---- + +[source,java,diff-id=22,diff-type=compliant] +---- +import com.nimbusds.jwt.SignedJWT; + +public void decode(String jwtString) { + SignedJWT jwt = SignedJWT.parse(jwtString); + + if (!jwt.verify(new MACVerifier(sharedSecret))) { + throw new JOSEException("JWT signature does not match"); + } +} +---- + +=== How does this work? + +include::../../common/fix/encode.adoc[] + +include::../../common/fix/decode.adoc[] + +=== Going the extra mile + +include::../../common/extra-mile/key-storage.adoc[] + +include::../../common/extra-mile/key-rotation.adoc[] + diff --git a/rules/S5659/java/rule.adoc b/rules/S5659/java/rule.adoc index 9e6c78a8f3e..2f5c1d801b1 100644 --- a/rules/S5659/java/rule.adoc +++ b/rules/S5659/java/rule.adoc @@ -12,6 +12,8 @@ include::how-to-fix-it/jjwt.adoc[] include::how-to-fix-it/java-jwt.adoc[] +include::how-to-fix-it/nimbus.adoc[] + == Resources include::../common/resources/standards.adoc[]