Class VapidJwt

java.lang.Object
com.iizix.server.push.engine.transport.VapidJwt
public final class VapidJwt extends Object
The VAPID (RFC 8292) authorization for a Web Push request: an ES256 JWT over the application's key pair, presented as Authorization: vapid t=<jwt>, k=<public key>.

The audience is the origin of the push endpoint - scheme, host and, when it is not the scheme's default, the port. The severed Notification.getOrigin dropped the port (IIZI-PUSH-012), which made every token for an endpoint on a non-default port invalid; origin(String) keeps it.

The token expires after EXPIRY_SECONDS (12 hours; RFC 8292 caps it at 24). It is minted per request rather than cached: the cost is one ECDSA signature, and a cached token near its expiry is the kind of intermittent failure nobody finds.

Author:
Christopher Mindus

  • Field Details

    • EXPIRY_SECONDS

      public static final long EXPIRY_SECONDS
      The token lifetime: 12 hours, in seconds.
      See Also:

  • Method Details

    • origin

      public static String origin(String endpoint)
      Computes the origin of a push endpoint for the aud claim.
      Parameters:
      endpoint - The push endpoint URL.
      Returns:
      scheme://host plus :port when the port is explicit and not the scheme's default.
      Throws:
      IllegalArgumentException - If the endpoint is not an absolute URL with a host.

    • mint

      public static String mint(String audience, String subject, PrivateKey privateKey) throws org.jose4j.lang.JoseException
      Mints the compact JWT.
      Parameters:
      audience - The endpoint origin from origin(String).
      subject - The sub claim, a mailto: or https: URI; null to omit.
      privateKey - The application's P-256 private key.
      Returns:
      The compact serialization.
      Throws:
      org.jose4j.lang.JoseException - If signing fails.

    • authorization

      public static String authorization(String endpoint, String subject, PrivateKey privateKey, byte[] publicKeyRaw) throws org.jose4j.lang.JoseException
      Builds the Authorization header value.
      Parameters:
      endpoint - The push endpoint URL.
      subject - The sub claim, null to omit.
      privateKey - The application's private key.
      publicKeyRaw - The application's public key, the 65-byte uncompressed point.
      Returns:
      vapid t=<jwt>, k=<base64url public key>.
      Throws:
      org.jose4j.lang.JoseException - If signing fails.