JJWT 0.13

Apply these rules to JJWT 0.13 on the JVM. This pack includes Java 25. JJWT supplies JOSE and JWT processing; the application still owns the token profile, OAuth/OIDC transaction, local session, and resource authorization.

Parser policy and token verification

• Build a dedicated immutable JwtParser for each token purpose and trusted issuer policy, then reuse it with thread-safe key locators. Keep parser and issuance builders out of shared request state; never weaken a shared parser to handle one exceptional token.
• Select the typed parse method for the expected format: parseSignedClaims for signed JWT claims, parseSignedContent for signed bytes, or the corresponding encrypted method for an explicit JWE profile. Generic parse, isSigned, header decoding, and shape checks do not establish the application's expected token type.
• Keep unsecured() and unsecuredDecompression() disabled for authentication and authorization inputs. Do not recover from a verification failure by reparsing an unsecured token, dropping its signature, or using claims exposed by ExpiredJwtException.
• Restrict sig() to the actual permitted algorithms: for example, .sig().clear().add(Jwts.SIG.RS256).and() for an RS256 profile. Adding one algorithm without clearing the default collection does not create an allowlist. Clear enc() and key() when the parser does not accept JWE.
• Use verifyWith(SecretKey) for the profile's HMAC key or verifyWith(PublicKey) for asymmetric verification. Replace ambiguous deprecated string/byte setSigningKey usage with typed keys; never