Having trouble upgrading from an old version of jjwt

[landryraccoon]

Hello,

I am having trouble updating an old Java 8 project that uses jjwt 0.7.0. I am trying to update to the latest version at this time which is 0.12.6.

Here is the existing code:

      Claims claims = Jwts.parser()
          .setSigningKey(secret)
          .parseClaimsJws(token)
          .getBody();

      String userClaim = claims.getSubject();
      Date expiration = claims.getExpiration();
      Date now = Date.from(clock.instant());
      if (expiration == null || expiration.before(now)) {
        throw new RequestUnauthorizedException("Token expired");
      }

I am getting the following exception:

TokenService.java:[151,11] cannot find symbol
[ERROR]   symbol:   method parseClaimsJws(java.lang.String)
[ERROR]   location: interface io.jsonwebtoken.JwtParserBuilder

Is there a guide or FAQ on migrating this code from an older version of JJWT? I would prefer to avoid having to do a major refactor or rewrite, just hoping there are some simple changes to get to a working version.

[bdemers]

Try the parseSignedClaims() method.
There are more details in the quickstart section of the README

Or the more detailed section on reading a JWS

[bdemers]

Sorry, I also forgot to answer the other part of your question 😄
Take a look at the changelog for details on these methods:
https://github.com/jwtk/jjwt/blob/master/CHANGELOG.md#backwards-compatibility-breaking-changes-warnings-and-deprecations

[lhazlewood]

Hi @landryraccoon!

There isn't a formal dedicated guide per se, but there is an extensive list of changes in the 0.12.0 https://github.com/jwtk/jjwt/blob/0.12.6/CHANGELOG.md#0120 following through to 0.12.6 that was written in a way meant to guide people going through an upgrade.

Also, most developers have the IDE tell them when a deprecated method is used, e.g. the method is often highlighted as a warning:

or when authoring:

Upon encountering such a method, we always indicate in JavaDoc what the alternative is. For example, seeing that setSigningKey has a line through it and is therefore deprecated, that method's JavaDoc says:

* @deprecated since 0.12.0 in favor of {@link #verifyWith(SecretKey)} for type safety and name
* congruence with the {@link #decryptWith(SecretKey)} method.

as well as the bold Deprecation Notice at the top of that method's JavaDoc.

So then we know to use verifyWith instead of setSigningKey.

If not using an IDE, the JavaCompiler will also print out deprecation warnings (unless overridden/disabled by the developer and/or build tool).

Anyway, in your code example, Jwts.parser() does not return a mutable parser any longer. Per the 0.12.0 changelog's section on breaking changes:

• io.jsonwebtoken.JwtParser is now immutable. All mutation/modification methods (setters, etc) deprecated 4 years ago have been removed. All parser configuration requires using the JwtParserBuilder.

• Similarly, io.jsonwebtoken.Jwts's parser() method deprecated 4 years ago has been changed to now return a JwtParserBuilder instead of a direct JwtParser instance. The previous Jwts.parserBuilder() method has been removed as it is now redundant.

(even if you didn't want to read a wall of text in that section, people often ctrl-F (or cmd-F) to find the method they care about and find that in the changelog).

Since Jwts.parser() now returns a builder, you have to build the parser and then call the respective parse method(s). So the above would be:

Claims claims = Jwts.parser()
        .verifyWith(secret)
        .build() // <----
        .parseSignedClaims(token)
        .getPayload();

And if you're using an IDE, it'll tell you the return value types associated with the various methods, e.g.

Anyway, I hope that's helpful! Feel free to ask anything else if you get stuck!

[lhazlewood]

Closing due to inactivity. Feel free to request to re-open if there's anything else!