[hendem]

Summary

Upgrades JwtValidator to .NET 10 and fixes several validation bugs, including one where JWKS validation used the wrong key. It also adds better diagnostics, opt-in claim checks, exit codes, unit tests and a CI build. The repo moves to a src/ + tests/ layout with a .slnx solution.

Bug fixes

• Only the last RSA key in a JWKS was ever used. Every key was imported into one shared RSA instance, so each key overwrote the previous one and kid was ignored. Tokens signed by any other key in the set failed. Keys are now loaded with JsonWebKeySet and matched by kid, with a fallback that tries every key. There is a regression test.
• --jwt-file didn't work with a trailing newline, which most files have; the token was reported as malformed. Input is now trimmed.
• EC keys in a JWKS were skipped and only RS256 was accepted. RS/PS/ES 256/384/512 are now supported.
• Sync-over-async HttpClient...Result with an undisposed client; legacy RSACryptoServiceProvider; manual validation returned an undisposed SHA256.
• The process always exited with 0, even when validation failed.
• All nullable warnings fixed; warnings are now errors.

Changes

• .NET 10: net10.0, with JwtSecurityTokenHandler replaced by JsonWebTokenHandler (Microsoft.IdentityModel.JsonWebTokens 8.23.0) and Newtonsoft.Json dropped.
• Layout: src/JwtValidator, tests/JwtValidator.Tests, JwtValidator.slnx (migrated from .sln), a shared Directory.Build.props, .editorconfig and global.json.
• Code structure: Program.cs is split into Options, KeyLoader, TokenValidator, TokenDiagnostics and ValidateCommand.
• Diagnostics: the output shows the decoded header and claims, plus iat/nbf/exp as UTC with expired/not-yet-valid status. It lists the key set, warns about unusable JWKS entries and a kid that isn't in the set, and gives a one-line failure reason (--verbose adds the full payload and error detail).
• New options: --issuer, --audience, --validate-lifetime, --clock-skew. All are off by default, so existing usage behaves the same.
• Exit codes: 0 valid, 1 invalid token, 2 usage or input error.
• Stricter input: passing both --jwt and --jwt-file, or more than one key source, is now a usage error. Previously one of them was silently ignored.
• CI: GitHub Actions builds and tests on push/PR to main.
• JwtValidator.csproj.user is no longer tracked.
• Docs: every method and type has XML doc comments, and GenerateDocumentationFile makes the compiler check them.
• All NuGet packages are on their latest versions (xunit.v3 4.0.2).

Testing

• dotnet test --solution JwtValidator.slnx: 56/56 pass. Tests sign tokens with RSA/EC keys generated in memory, so no key material is committed.
• Manual CLI checks:
  • --help/--version exit 0; missing or conflicting options exit 2; a missing file exits 2.
  • A malformed token exits 1.
  • The jwks file launch-profile token validates against the live --jwks-url and reports the matching kid.
• The good key / bad key / key2 launch-profile tokens don't validate against their inline JWKS. The original code on main rejects them too, so that's stale sample data, not a regression.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

A malformed JWKS throws InvalidDataException, which escapes ValidateCommand's catch filter and crashes the process instead of returning the documented exit code 2.

1 open finding

• JWKS parsing InvalidDataException escapes and crashes CLI · New

What changed in this PR

This PR modernizes the JwtValidator CLI troubleshooting tool. It upgrades the target framework from .NET 8 to .NET 10, replaces the deprecated JwtSecurityTokenHandler/Newtonsoft.Json stack with JsonWebTokenHandler (Microsoft.IdentityModel.JsonWebTokens 8.23.0), and restructures the single Program.cs into focused types (Options, KeyLoader, TokenValidator, TokenDiagnostics, ValidateCommand, ExitCodes). It fixes several real validation bugs (notably JWKS multi-key handling that previously only used the last RSA key, trailing-newline handling in --jwt-file, EC key support, and undisposed crypto/HTTP resources), adds rich diagnostics output, opt-in claim checks, process exit codes, a src/ + tests/ layout with a .slnx solution, a comprehensive xUnit v3 test suite, and a GitHub Actions CI workflow.

Changes:

• Upgrade to .NET 10 and switch to JsonWebTokenHandler; load JWKS via JsonWebKeySet with kid-aware matching and support for RS/PS/ES 256/384/512.
• Split Program.cs into cohesive components, add diagnostics, new claim-check options, and standardized exit codes (0/1/2).
• Introduce repository restructure (src/, tests/, .slnx, Directory.Build.props, .editorconfig, global.json), unit tests, and a CI build/test workflow.

File	Description
src/​JwtValidator/​ValidateCommand.cs	Orchestrates read/load/validate and maps outcomes to exit codes; catch filter omits InvalidDataException.
src/​JwtValidator/​KeyLoader.cs	Loads keys from PEM/JWKS (URL/file/JSON); describes every JWKS entry; RSA parameter extraction.
src/​JwtValidator/​TokenValidator.cs	Builds validation parameters and performs handler-based and manual RSA signature validation.
src/​JwtValidator/​TokenDiagnostics.cs	Renders human-readable token/key diagnostics, time humanization, and lifetime notes.
src/​JwtValidator/​Options.cs	CLI options plus usage-error validation for token/key source combinations and clock skew.
src/​JwtValidator/​Program.cs	Entry point: arg parsing, help/version handling, usage errors, and command dispatch.
src/​JwtValidator/​ExitCodes.cs	Centralizes 0/1/2 exit-code constants.
src/​JwtValidator/​JwtValidator.csproj	Targets new package set, adds InternalsVisibleTo for tests.
src/​JwtValidator/​Properties/​launchSettings.json	Dev launch profiles (sample tokens/JWKS, some stale).
tests/​JwtValidator.Tests/​*.cs	xUnit v3 tests for options, key loading, validation, diagnostics, and the command.
tests/​JwtValidator.Tests/​JwtValidator.Tests.csproj	Test project referencing xunit.v3 and the main project.
Directory.Build.props /​ global.json /​ .editorconfig	Shared build settings, SDK/test-runner pinning, and style rules.
JwtValidator.slnx /​ JwtValidator.sln	Migrates to the .slnx solution format.
.github/​workflows/​build.yml	CI build and test on push/PR to main.
README.md /​ .gitignore	Rewritten usage docs; broader ignore rules; untracks *.user.
JwtValidator/​Program.cs, *.csproj.user	Removes the old flat-layout source and tracked user file.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.