From 3.19.4 to 4.4.0: IncorrectClaimException on verify() about java-jwt HOT 5 CLOSED

thank you @jimmyjames for the really comprehensive answer

from java-jwt.

Thanks @borgogelli for the details and reproduction steps, we'll look into it this week and release a fix if needed. Thanks!

from java-jwt.

@borgogelli the exception you are seeing is because the actual audience in the JWT does not match the expected audience in the validation (the actual JWT's audience is 0a002700000b, while you have configured the validation to expect 0A002700000B - just incorrect casing). So the exception occurs because the audience does not match. If you were to comment out the audience validation (just to test) you'd receive an TokenExpiredException as expected.

from java-jwt.

e in the JWT does not match the expected audience in the validation (the actual JWT's audience is 0a002700000b, while you have configured the validation t

Hi @jimmyjames thank you for the reply
The question is why does the same test pass with version 3.19.4 ?

from java-jwt.

@borgogelli - in v3 the exp claim is validated prior to the aud claim, resulting in the TokenExpiredException being thrown prior to validating the aud claim (which would throw an IncorrectClaimException if the exp claim were valid). Both cases result in an invalid JWT but different types of JWTVerificationException being thrown due to the order of validation.

from java-jwt.