Description
JwtDecoder and ReactiveJwtDecoder could be improved by determining the JWS algorithm from the JWK Set endpoint.
This is something already supported in Nimbus via:
URL url = new URL("https://idp.example.org/.well-known/jwks.json");
JWSKeySelector selector =
JWSAlgorithmFamilyJWSKeySelector.fromJWKSetURL(url);The result would be that on startup, the application would hit the JWK Set endpoint, inspect the kty field of the JWKs returned, and infer the algorithm or algorithms that the decoder should support accordingly. Perhaps this could be delayed, though, until the first request comes in.
If an application wants to skip this auto-configuration, it can easily do so by specifying using NimbusJwtDecoder directly:
String jwkSetUri = "https://idp.example.org/.well-known/jwks.json";
JwtDecoder decoder = NimbusJwtDecoder.fromJwkSetUri(jwkSetUri).build();Care will need to be taken to ensure that this change is passive. For example, NimbusJwtDecoder selects RS256 by default. For those still picking the defaults, it'd be unfortunate if the algorithms selected by reading the JWKS response didn't include RS256.