Class IssuerUtils

java.lang.Object
io.micronaut.security.token.IssuerUtils
@Internal public final class IssuerUtils extends Object
Utility class to compare issuers, such as the iss claim of a token against the issuer expected for a key set or an OpenID client.

Unlike ClaimsUtils.equalsIgnoringProtocolAndTrailingSlash(String, String), a missing scheme or a different scheme is a mismatch (http:// is not https://), as OpenID Connect Core 1.0 section 3.1.3.7 requires; no suffix or parent domain is tolerated either. It is meant to run on untrusted input before a token is verified, so it allocates no state per distinct value.

Since:
5.5.2
Author:
Sergio del Amo

  • Method Details

    • equivalent

      public static boolean equivalent(@Nullable String expected, @Nullable String actual)
      Compares two issuers. They are equal if they are identical, ignoring the case of the scheme (folded for ASCII only) and a single trailing slash. The slash is only ignored when the issuer has no query (?) and no fragment (#), where it would be part of that component. Nothing else is tolerated: the host, port, userinfo, path, query and fragment must be identical, and a different scheme or a missing scheme is a mismatch.
      Parameters:
      expected - The expected issuer
      actual - The issuer to compare
      Returns:
      true if both issuers are non-null, non-empty and equal