java-jwt (Auth0)

Facts and the checks behind them

Nothing below is copied from documentation. The check content/libraries/verify/java-jwt/run.sh ran java-jwt (Auth0) 4.6.2 in the container image maven:3.9.16-eclipse-temurin-25 on October 20, 2026; the page must match what it printed, and each fact lists those lines.

• JWS algorithms

  HS256HS384HS512RS256RS384RS512ES256ES384ES512

  HS, RS and ES at 256/384/512 signed and verified; the Algorithm factory has no PS*, ES256K or EdDSA.

  Recorded by the check

  fact jws-algorithms = HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512
  evidence jws-algorithms: Algorithm factory methods: HMAC256/384/512, RSA256/384/512, ECDSA256/384/512, none; no PS*, ES256K or EdDSA

• ES256 signature encoding

  raw

  ES256 signatures are 64 bytes of raw r‖s.

  Recorded by the check

  fact jws-ecdsa-encoding = raw

• DER signature inside a JWS

  rejected

  A DER-encoded ES256 signature fails with SignatureVerificationException: The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA.

  Recorded by the check

  fact jws-der-signature = rejected
  evidence jws-der-signature: SignatureVerificationException: The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA

• Algorithm allow-list

  required

  A verifier is bound to one Algorithm: an RS256 token against JWT.require(ECDSA256) failed with AlgorithmMismatchException.

  Recorded by the check

  fact jwt-algorithm-allowlist = required
  evidence jwt-algorithm-allowlist: JWT.require(ECDSA256) on an RS256 token: AlgorithmMismatchException: The provided Algorithm doesn't match the one defined in the JWT's Header.

• Unsigned tokens (alg none)

  opt-in

  An ES256 verifier rejects unsigned tokens; JWT.require(Algorithm.none()) accepts them.

  Recorded by the check

  fact jwt-alg-none = opt-in
  evidence jwt-alg-none: JWT.require(ECDSA256): AlgorithmMismatchException: The provided Algorithm doesn't match the one defined in the JWT's Header.
  evidence jwt-alg-none: JWT.require(Algorithm.none()): verified

• Public key used as an HMAC secret

  rejected

  An HS256 token keyed with the PEM text failed against the ES256 verifier, but Algorithm.HMAC256(pemBytes) verified it.

  Recorded by the check

  fact jwt-hmac-public-key = rejected
  evidence jwt-hmac-public-key: JWT.require(ECDSA256): AlgorithmMismatchException: The provided Algorithm doesn't match the one defined in the JWT's Header.
  evidence jwt-hmac-public-key: JWT.require(Algorithm.HMAC256(PEM bytes)): verified

• Curve checked against alg

  enforced

  Algorithm.ECDSA256 with a P-384 key fails to sign with SignatureGenerationException.

  Recorded by the check

  fact jwt-ecdsa-curve-check = enforced
  evidence jwt-ecdsa-curve-check: SignatureGenerationException: The Token's Signature couldn't be generated when signing using the Algorithm: SHA256withECDSA

• Default clock skew

  0s

  No leeway by default: a token expired three seconds earlier was rejected.

  Recorded by the check

  fact jwt-clock-skew = 0s

• Expiry claim required

  no

  A token without exp verified; withClaimPresence("exp") requires it.

  Recorded by the check

  fact jwt-exp-required = no

Usage

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.ECPublicKey;
import java.security.spec.ECGenParameterSpec;
import java.time.Instant;

public class Usage {
    public static void main(String[] args) throws Exception {
        KeyPairGenerator generator = KeyPairGenerator.getInstance("EC");
        generator.initialize(new ECGenParameterSpec("secp256r1"));
        KeyPair pair = generator.generateKeyPair();
        Algorithm es256 = Algorithm.ECDSA256((ECPublicKey) pair.getPublic(), (ECPrivateKey) pair.getPrivate());

        String token = JWT.create().withSubject("user-42").withIssuer("https://auth.example.com")
            .withExpiresAt(Instant.now().plusSeconds(600)).sign(es256);

        // JWT.require() verifies; JWT.decode() only parses. Require exp and allow some leeway.
        DecodedJWT verified = JWT.require(es256).withIssuer("https://auth.example.com")
            .withClaimPresence("exp").acceptLeeway(30).build().verify(token);
        System.out.println("sub: " + verified.getSubject());
    }
}