Thanks a lot to @drbild for helping review the code around security vulnerabilities.
Now on Maven
All the sub-projects are now released directly on Maven Central. Since Sonatype didn't accept pdi as the groupId, I had to change it to com.pauldijou. Sorry about that, you will need to quickly update your build.sbt (or whatever file contains your dependencies).
Breaking changes
Good news Those changes don't impact the jwt-play lib, only low level APIs.
All decoding and validating methods with a key: String are now removed for security reasons. Please use their counterpart which now needs a 3rd argument corresponding to the list of algorithms that the token can be signed with. This list cannot mix HMAC and asymetric algorithms (like RSA or ECDSA). This is to prevent a server using RSA with a String key to receive a forged token signed with a HMAC algorithm and the RSA public key to be accepted using the same RSA public key as the HMAC secret key by default. You can learn more by reading this article.
// Before
val claim = Jwt.decode(token, key)
// After (knowing that you only expect a HMAC 256)
val claim = Jwt.decode(token, key, Seq(JwtAlgorithm.HS256))
// After (supporting all HMAC algorithms)
val claim = Jwt.decode(token, key, JwtAlgorithm.allHmac)If you are using SecretKey or PublicKey, the list of algorithms is optional and will be automatically computed (using JwtAlgorithm.allHmac and JwtAlgorithm.allAsymetric respesctively) but feel free to provide you own list if you want to restrict the possible algorithms. More security never killed any web application.
Why not deprecate them? I considered doing that but I decided to enforce the security fix. I'm pretty sure that most people only use one HMAC algorithm with a String key and it will force them to edit their code but it should be a minor edit since you usually only decode tokens once or twice inside a code base. The fact that the project is still very new and at a 0.x version played in the decision.
Fixes
Fix a security vulnerability around timing attacks.
Features
Add implicit class to convert JwtHeader and JwtClaim to JsValue or JValue. See examples for Play JSON or examples for Json4s.
// Play JSON
JwtHeader(JwtAlgorithm.HS256).toJsValue
JwtClaim().by("me").to("you").about("something").issuedNow.startsNow.expiresIn(15).toJsValue
// Json4s
JwtHeader(JwtAlgorithm.HS256).toJValue
JwtClaim().by("me").to("you").about("something").issuedNow.startsNow.expiresIn(15).toJValue