[Investigation] Possible improper use of the JJWT API in JwtUtil

[GabrielNat1]

Incorrect Use of JJWT APIs in JwtUtil

I identified incorrect usage of the JJWT library APIs in src/main/java/com/example/spring_boot_project/security/JwtUtil.java, which is likely to cause runtime failures and security risks during token verification and extraction.

Evidence

• generateToken(): uses Jwts.builder().claims() followed by .and() and .signWith(secretKey) — the .and() sequence is not part of the typical JJWT API and may generate invalid tokens or throw exceptions.
• extractUsername(): uses Jwts.parser().verifyWith(secretKey).build().parseSignedClaims(token).getPayload().getSubject(); The correct parsing/validation APIs typically use parseClaimsJws(token) or parserBuilder() in version 0.11.x.

Impact

• JWT tokens may not be generated or validated correctly, leading to authentication failures or security vulnerabilities.
• Incorrect token parsing can compromise the reliability and security of the authentication mechanism.

Recommendations

1. Update the implementation to use the correct API for the targeted JJWT version. Example (JJWT 0.11+):

   Generate:

   Jwts.builder()
       .setSubject(username)
       .setIssuedAt(...)
       .setExpiration(...)
       .signWith(secretKey, SignatureAlgorithm.HS256)
       .compact();

Validate/extract:

Jwts.parserBuilder()
    .setSigningKey(secretKey)
    .build()
    .parseClaimsJws(token)
    .getBody()
    .getSubject();

Ensure that the secret key meets the minimum required length/entropy requirements and that it is stored in an environment variable or secret manager.
Add unit tests covering token generation and validation, including expired and invalid tokens.
Related Files
src/main/java/com/example/spring_boot_project/security/JwtUtil.java
docs/security/jwt.md (code examples to be reviewed)