[CXF-7760] JOSE: JwsCompactConsumer parsing headers issue

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.13
• Fix Version/s: 3.2.6, 3.1.17
• Component/s: JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: J.J. Roldan
• Created: 13/Jun/18 07:57
• Updated: 03/Oct/18 13:33
• Resolved: 25/Jun/18 17:09

Description

When using the JwsCompactConsumer with a compact JWT whose kid contains a slash, the json parser escapes it, which causes issues later on while matching the kid to the one specified in the JWKS. For example:

Header:

{ "kid": "4pZbe4shQQGzZXHbeIlbDvmHOc1/H6jH6oBk3nUrcZE=", "alg": "RS256" }