rootvector2 commented on PR #3636: URL: https://github.com/apache/cxf/pull/3636#issuecomment-6460634380
Done. Added `allowX509KeyHeaders` (default `false`). When it's off, `null` headers are passed so only the `signatureUsername` cert is used. When it's on, `jwt.getJwsHeaders()` is passed as before. The setter javadoc carries the trust warning and recommends a dedicated signature crypto. `testTokenSignedByTrustedCertificate` still covers the default, and `testTokenSignedByTrustedCertificateWithX509KeyHeadersAllowed` checks that the x5t-selected cert validates with the flag on. I also fixed the class javadoc to say JWT. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
