各类JWT库(java)

浅浅的花香味﹌ 2022-12-31 14:21 119阅读 0赞

**在 [https://jwt.io/][https_jwt.io] 网站中收录有各类语言的JWT库实现(有关JWT详细介绍请访问 [https://jwt.io/introduction/][https_jwt.io_introduction]),**

**其中JAVA语言到目前(2018-06)有6个实现库,如下图:**

**![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70][]**

**按顺序依次是**

**Auth0实现 的 java-jwt**

**Brian Campbell实现的 jose4j**

**connect2id实现的 nimbus-jose-jwt**

**Les Haziewood实现的 jjwt**

**Inversoft实现的prime-jwt**

**Vertx实现的vertx-auth-jwt.**

![750a96f1213fde619ab85ab1c8d2e3e5.png][]

**以下是各个库的使用测试**

--------------------

*  ### **java-jwt** ###

**![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 1][]**

**完整测试链接  [https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/Auth0JwtTest.java][https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_Auth0JwtTest.java]**

***点评:***

Auth0提供的JWT库简单实用, 依赖第三方(如JAVA运行环境)提供的证书信息(keypair);

有一问题是在 生成id\_token与 校验(verify)id\_token时都需要 公钥(public key)与密钥(private key), 个人感觉是一不足(实际上在校验时只需要public key即可)

![750a96f1213fde619ab85ab1c8d2e3e5.png][]

*  ### **jose4j** ###

**![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 2][]**

**完整测试链接: [https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/Jose4JTest.java][https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_Jose4JTest.java]**

***点评:***

jose4j提供了完整的JWT实现, 可以不依赖第三方提供的证书信息(keypair, 库本身自带有RSA的实现),类定义与JWT协议规定匹配度高,易理解与上手

对称加密与非对称加密都有提供实现

![750a96f1213fde619ab85ab1c8d2e3e5.png][]

*  ### **nimbus-jose-jwt** ###

**![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 3][]**

** ![750a96f1213fde619ab85ab1c8d2e3e5.png][]**

**完整测试链接: [https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/NimbusJoseJwtTest.java][https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_NimbusJoseJwtTest.java]**

***点评:***

nimbus-jose-jwt库类定义清晰,简单易用,易理解 , 依赖第三方提供的证书信息(keypair), 对称算法 与非对称算法皆有实现.

--------------------

*  ### **jjwt** ###

**![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 4][]**

** **

![750a96f1213fde619ab85ab1c8d2e3e5.png][]

**完整测试链接: [https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/JJwtTest.java][https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_JJwtTest.java]**

***点评:***

jjwt小巧够用, 但对JWT的一些细节包装不够, 比如 Claims (只提供获取header,body)

*  --------------------
    
    ### **prime-jwt** ###

**![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 5][]**

** **

![750a96f1213fde619ab85ab1c8d2e3e5.png][]

**完整测试链接: [https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/PrimeJwtTest.java][https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_PrimeJwtTest.java]**

***点评:***

prime jwt库怎么说呢, 有些地方不符合JAVA语言规范, 支持对称算法(HMAC) 与非对称算法(RSA), 也算容易理解

--------------------

*  ### **vertx-auth-jwt** ###

**![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 6][]**

**完整测试链接: [https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/VertxAuthJwtTest.java][https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_VertxAuthJwtTest.java]**

*** 点评:***

Vertx Auth Jwt 库算是最不容易理解的一个库了.花了不少时间才弄通这一示例. 不容易上手. 并且生成与校验id\_token 时都需要公钥与私钥,不足.

--------------------

**以下是在使用中的一些总结或注意点**

**1. 几乎所有库都要求JAVA版本1.7或更高版本, 1.6或以下的版本需要二次开发(或不支持)**

**2.从易用性, 扩展性, 完整性等来看, 使用首先推荐 jose4j, 其次是 Nimbus-jose-jwt.**

**3. JWT是实现OIDC的基石,掌握其使用对实现OIDC有很大帮助(同时对JAVA证书使用, PKI体系的掌握也有要求)**

**[https://github.com/monkeyk/MyOIDC][https_github.com_monkeyk_MyOIDC]**

[https_jwt.io]: https://jwt.io/
[https_jwt.io_introduction]: https://jwt.io/introduction/
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70]: /images/20221120/b890fd231db74149957541aab772031f.png
[750a96f1213fde619ab85ab1c8d2e3e5.png]: /images/20221120/9de75ebc17b74df580e5e4f7c013992b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 1]: /images/20221120/b0f788da41904c4e8d853dbd785b17a8.png
[https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_Auth0JwtTest.java]: https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/Auth0JwtTest.java
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20201230095438959.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4,size_16,color_FFFFFF,t_70
[https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_Jose4JTest.java]: https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/Jose4JTest.java
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20201230095459160.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4,size_16,color_FFFFFF,t_70
[https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_NimbusJoseJwtTest.java]: https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/NimbusJoseJwtTest.java
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20201230095539296.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4,size_16,color_FFFFFF,t_70
[https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_JJwtTest.java]: https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/JJwtTest.java
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20201230095555331.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4,size_16,color_FFFFFF,t_70
[https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_PrimeJwtTest.java]: https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/PrimeJwtTest.java
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/20201230095619407.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNTcwNjU4,size_16,color_FFFFFF,t_70
[https_github.com_monkeyk_MyOIDC_blob_1.1.0_myoidc-server_src_test_java_myoidc_server_infrastructure_VertxAuthJwtTest.java]: https://github.com/monkeyk/MyOIDC/blob/1.1.0/myoidc-server/src/test/java/myoidc/server/infrastructure/VertxAuthJwtTest.java
[https_github.com_monkeyk_MyOIDC]: https://github.com/monkeyk/MyOIDC