Read the payload written by withPayload #725

Activity

1. bmaehr

   added

   feature requestA feature has been asked for or suggested by the communityA feature has been asked for or suggested by the community

   on Sep 2, 2025
2. marktech0813 commented on Nov 10, 2025

   

   marktech0813

   on Nov 10, 2025

   More actions

   Hi, Can I handle this issue?

   ❤️React with ❤️1Reacted by bmaehr
3. marktech0813

   added a commit that references this issue on Nov 10, 2025

   Fix -- Read the payload written by withPayload auth0#725

   ...

   c56b980
4. marktech0813 commented on Nov 21, 2025

   

   marktech0813

   on Nov 21, 2025

   More actions

   Please check PR.
   thanks.
5. tanya732 commented on Feb 10, 2026

   

   tanya732

   on Feb 10, 2026

   Contributor

   More actions

   Hi @bmaehr

   Thank you for raising the issue!!

   This does add convenience, but we want to be careful here. Exposing decoded header or payload JSON directly may encourage consumers to rely on unverified JWT data, since decoding does not imply signature verification. While the data is already accessible today, adding a dedicated API makes this usage more prominent.

   Could you share the concrete use case you’re trying to solve with this change? That context will help us decide whether this belongs in the core API and, if so, how we should document or name it to avoid accidental misuse.

   Thank you
6. bmaehr commented on Feb 10, 2026

   

   bmaehr

   on Feb 10, 2026

   Last edited by bmaehr

   Author

   More actions

   When creating the JWT I can do something like this:

               String payloadValue = null;
               try {
                   payloadValue = objectMapper.writeValueAsString(payload);
               } catch (final JsonProcessingException ex) {
                   throw new TechnicalException("Serializing payload value '{}' to json has failed.", payload.toString(), ex);
               }
               builder.withPayload(payloadValue);
   
   

   On the other hand I would like to do while decoding

               final DecodedJWT decodedJWT = decodedJWT(jwtToken, publicKey, keyType);
               final String payloadBase64 = decodedJWT.getPayload();
               final String payload = new String(Base64.getUrlDecoder().decode(payloadBase64), StandardCharsets.UTF_8);
               return objectMapper.readValue(payload , payloadClass);