Nimbus JOSE + JWT 2.13.1 maintenance release
We just released a maintenance release of the Java library for creating and processing plain, JWS and JWE objects and JSON Web Tokens (JWTs).
The new release fixes a JWT time unit representation bug that used milliseconds instead of seconds for the exp, nbf and iat claims.
It also ensures that Header.toBase64() returns the original parsed string for JOSE objects that are being processed. This bug was causing false HMAC integrity check rejections in situations where the sending and the receiving system produce JSON headers with different serialisations.
Thanks to Jochem Berndsen and to Wisgary Torres from the Microsoft XBox team for reporting these issues.
The new release should become available on Maven Central within a few hours.