Nimbus JOSE + JWT 10.10

Apply these rules to Nimbus JOSE + JWT 10.10 on the JVM. This pack includes Java 25. The library supplies JOSE and JWT primitives; OAuth/OIDC transactions, account linking, sessions, and resource authorization still require an application policy.

Processor and token profiles

• Configure a dedicated DefaultJWTProcessor for each issuer and token purpose before sharing it. Keep its selectors, verifiers, accepted-algorithm sets, and key sources stable during requests; pass immutable copies of application policy collections instead of mutating them after configuration.
• Process authentication tokens through the configured processor and reject every parse, JOSE, and claim-validation failure. JWTParser.parse, SignedJWT.parse, decoded claims, and a successful JWE decryption alone do not establish the expected authenticated token.
• Set an explicit DefaultJOSEObjectTypeVerifier for the expected typ, such as at+jwt for that access-token profile. The default JWT verifier permits an absent type; do not include null among allowed types unless the application's separate profile explicitly permits omission.
• Supply a fixed algorithm or narrow set to JWSVerificationKeySelector and a trusted issuer-specific JWKSource. The verifier factory's supported algorithms are capabilities, not the application's allowlist; never derive policy from the received alg or mix an asymmetric issuer key with HMAC verification.
• Keep PlainJWT rejection intact. Do not override the processor to accept unsigned authentication tokens or retry a failed token with a weaker verifier, a