[CXF-9033] getSignatureAlgorithm ignores alg value set within JWS header

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 3.5.8, 3.6.3, 4.0.4
• Component/s: JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Jan Bernhardt
• Created: 26/Jun/24 08:14
• Updated: 07/Aug/24 07:42
• Resolved: 07/Aug/24 07:42

Description

The `getSignatureAlgorithm` method from the JwsUtils ignore any value set within the "alg" JWS header, instead the code looks for a static JAX-RS property (rs.security.signature.algorithm) or tries to detect the algorithm based on the selected alias in a keystore file. This makes it more complicated to configure a CXF provider and limits the token validation to a single specified algorythm. Using the header value instead would avoid such additional configuration properties and make the solution more dynamic.