Class JWTValidator

java.lang.Object

com.hypixel.hytale.server.core.auth.JWTValidator

public class JWTValidator
extends Object

Validates JWT access tokens from the Session Service.

This validator: - Parses JWT structure and verifies signature using JWKS - Validates standard claims (iss, aud, exp, nbf, iat) - Validates certificate binding (cnf.x5t#S256) - Caches JWKS (JSON Web Key Set) for signature verification

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	JWTValidator.IdentityTokenClaims	Parsed and validated identity token claims (from launcher).
static class	JWTValidator.JWTClaims	Parsed and validated JWT claims.
static class	JWTValidator.SessionTokenClaims	Parsed and validated session token claims.

Constructor Summary

Constructors

Constructor	Description
JWTValidator(SessionServiceClient sessionServiceClient, String expectedIssuer, String expectedAudience)	Creates a new JWT validator.

Method Summary

Modifier and Type	Method	Description
void	invalidateJwksCache()	Invalidates the JWKS cache, forcing a fresh fetch on next validation.
JWTValidator.IdentityTokenClaims	validateIdentityToken(String identityToken)	Validates an identity token (JWT from launcher).
JWTValidator.IdentityTokenClaims	validateOfflineToken(String offlineToken)	Validates an offline token JWT.
JWTValidator.SessionTokenClaims	validateSessionToken(String sessionToken)	Validates a session token JWT.
JWTValidator.JWTClaims	validateToken(String accessToken, X509Certificate clientCert)	Validates a JWT access token.

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

JWTValidator

public JWTValidator(@Nonnull
 SessionServiceClient sessionServiceClient,
 @Nonnull
 String expectedIssuer,
 @Nonnull
 String expectedAudience)

Creates a new JWT validator.

Parameters:

sessionServiceClient - Client for fetching JWKS

expectedIssuer - The expected issuer (iss claim), e.g., "https://sessions.example/"

expectedAudience - The expected audience (aud claim), typically the server identifier

Method Details

validateToken

@Nullable
public JWTValidator.JWTClaims validateToken(@Nonnull
 String accessToken,
 @Nullable
 X509Certificate clientCert)

Validates a JWT access token.

Parameters:

accessToken - The JWT access token

clientCert - The client certificate from the mTLS connection (for binding validation)

Returns:

The validated claims, or null if validation fails

validateOfflineToken

@Nullable
public JWTValidator.IdentityTokenClaims validateOfflineToken(@Nonnull
 String offlineToken)

Validates an offline token JWT. Offline tokens are per-profile tokens issued by the launcher for offline/singleplayer mode. Validates signature, expiration, and checks for the offline scope.

Parameters:

offlineToken - The offline token JWT

Returns:

The validated identity token claims, or null if validation fails

invalidateJwksCache

public void invalidateJwksCache()

Invalidates the JWKS cache, forcing a fresh fetch on next validation.

validateIdentityToken

@Nullable
public JWTValidator.IdentityTokenClaims validateIdentityToken(@Nonnull
 String identityToken)

Validates an identity token (JWT from launcher). Unlike access tokens, identity tokens don't have cert binding or audience claims. We only verify signature and expiration.

Parameters:

identityToken - The identity token JWT

Returns:

The validated claims, or null if validation fails

validateSessionToken

@Nullable
public JWTValidator.SessionTokenClaims validateSessionToken(@Nonnull
 String sessionToken)

Validates a session token JWT. Lightweight validation that checks signature and expiration only. Unlike identity tokens, session tokens don't require a valid subject UUID.

Parameters:

sessionToken - The session token JWT

Returns:

The validated claims, or null if validation fails