amichair commented on PR #2744: URL: https://github.com/apache/james-project/pull/2744#issuecomment-3005188556
A compromise which I think you might feel better with is option 2 - leave the current design changes (untangling the old design and getClaimWithoutSignatureVerification loophole that no longer works, use a separate provider kid lookup method in the interface instead of creating a new provider with the key chosen at construction time, and have everything work with the new jjwt api), but split just the default provider thumbprint calculation into a separate PR that we can think about or discuss later. So the current implementation of the kid lookup in the default provider will always return null (with a TODO comment) and thus fallback to scan all keys, as it did before. Other than the kid calculation, do you like the rest of the design changes? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
