Changed from JWT token to public/privat key

src/main/java/core_service/configuration/security/JwtConfig.java

@@ -11,6 +11,6 @@ import org.springframework.context.annotation.Configuration;
 @ConfigurationProperties(prefix = "security.jwt")
 public class JwtConfig {
 
-    private String secret;
+    /** Base64-encoded X.509 DER Ed25519 public key. Verify-only; private key lives in Auth. */
+    private String publicKey;
 }
-

src/main/java/core_service/configuration/security/JwtService.java

@@ -1,24 +1,37 @@
 package core_service.configuration.security;
 
 import io.jsonwebtoken.Jwts;
-import io.jsonwebtoken.security.Keys;
+import jakarta.annotation.PostConstruct;
 import org.springframework.stereotype.Service;
 
-import javax.crypto.SecretKey;
-import java.nio.charset.StandardCharsets;
+import java.security.KeyFactory;
+import java.security.PublicKey;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.Base64;
 
+/**
+ * Verifies JWTs issued by tbp-auth-service. Verify-only: holds the Ed25519 public key.
+ */
 @Service
 public class JwtService {
 
+    private static final String ED25519 = "Ed25519";
+
     private final JwtConfig jwtConfig;
+    private PublicKey publicKey;
 
     public JwtService(JwtConfig jwtConfig) {
         this.jwtConfig = jwtConfig;
     }
 
+    @PostConstruct
+    void init() {
+        this.publicKey = decodePublicKey(jwtConfig.getPublicKey());
+    }
+
     public String extractEmail(String token) {
         return Jwts.parser()
-                .verifyWith(getSigningKey())
+                .verifyWith(publicKey)
                 .build()
                 .parseSignedClaims(token)
                 .getPayload()
@@ -27,7 +40,7 @@ public class JwtService {
 
     public String extractUserId(String token) {
         return Jwts.parser()
-                .verifyWith(getSigningKey())
+                .verifyWith(publicKey)
                 .build()
                 .parseSignedClaims(token)
                 .getPayload()
@@ -36,7 +49,7 @@ public class JwtService {
 
     public Long extractSteamId(String token) {
         return Jwts.parser()
-                .verifyWith(getSigningKey())
+                .verifyWith(publicKey)
                 .build()
                 .parseSignedClaims(token)
                 .getPayload()
@@ -46,7 +59,7 @@ public class JwtService {
     public boolean isTokenValid(String token) {
         try {
             Jwts.parser()
-                    .verifyWith(getSigningKey())
+                    .verifyWith(publicKey)
                     .build()
                     .parseSignedClaims(token);
             return true;
@@ -55,10 +68,12 @@ public class JwtService {
         }
     }
 
-    private SecretKey getSigningKey() {
-        String secretKey = jwtConfig.getSecret();
-        byte[] keyBytes = secretKey.getBytes(StandardCharsets.UTF_8);
-        return Keys.hmacShaKeyFor(keyBytes);
+    private static PublicKey decodePublicKey(String base64X509Der) {
+        try {
+            byte[] keyBytes = Base64.getDecoder().decode(base64X509Der);
+            return KeyFactory.getInstance(ED25519).generatePublic(new X509EncodedKeySpec(keyBytes));
+        } catch (Exception e) {
+            throw new IllegalStateException("Failed to decode Ed25519 public key", e);
+        }
     }
 }
-

src/main/resources/application-dev.yml

@@ -16,4 +16,5 @@ spring:
 
 security:
   jwt:
-    secret: "NzC9tQP1eTp496SxoVYslH1bqn81Tbfz74NjkFqdcVe7wayjcRN8IeZvJWd1s6NEWgwEXe9rdccvOn2HtJ4fdq"
+    # Dev-only Ed25519 public key. Must match Auth's dev private key.
+    public-key: "MCowBQYDK2VwAyEAPSmUISg0IUO1LrRPhF8RZAT/Yjh9HEVf5hzR84AL1Zw="

src/main/resources/application.yml

@@ -36,7 +36,7 @@ management:
           enabled: true
 security:
   jwt:
-    secret: ${JWT_SECRET}
+    public-key: ${JWT_PUBLIC_KEY}
 app:
   cors:
     allowed-origins: "https://tbp.andreas-dahm.eu"