Fix ClassCastException in JwtDecoders fromIssuerLocation

[tiborkoch]

Fix for #9651

[jzheaux]

Thanks for the PR, @tiborkoch! Please see my review comments inline.

In addition, would you please include the issue number in your squashed Git commit? Something like this:

Fix ClassCastException

Closes gh-9651

[jzheaux]

Thanks, @tiborkoch! This is now merged into master.

[Blockost]

I'm having the exact same issue but with [email protected]. I set spring.security.oauth2.resourceserver.jwt.jwk-set-uri to my Auth0 endpoint but without success.

The line that raises the error is the one at 411 of class NimbusReactiveJwtDecoder:

private JWKSelector createSelector(Function<JWSAlgorithm, Boolean> expectedJwsAlgorithms, Header header) {
	JWSHeader jwsHeader = (JWSHeader) header; // <--- Error thrown here !
	if (!expectedJwsAlgorithms.apply(jwsHeader.getAlgorithm())) {
		throw new BadJwtException("Unsupported algorithm of " + header.getAlgorithm());
	}
	return new JWKSelector(JWKMatcher.forJWSHeader(jwsHeader));
}

I'm using:

• spring boot 2.6.3 and spring-boot-starter-oauth2-resource-server
• It's using ReactiveJwtDecoder because I'm building an app with RSocket and spring-boot-starter-rsocket

Not sure what I can do to fix this... 🤔

[dhaeb]

@Blockost how did you deal with this issue? We created our own NimbusReactiveJwtDecoder but are not happy to maintain this code.
It seems like that:
NimbusJwtDecoder.withJwkSetUrican handle JWE, the reactive version NimbusReactiveJwtDecoder.withJwkSetUri does not work for us...

We are using Spring Security version 6.1.6