Thread safety issue with Services class / ServiceLoader about jjwt

[gavanore]

Glad to be of use. Thank you for creating this library.

[lhazlewood]

@gavanore excellent catch! Thank you so much for creating this issue. The work for the 0.12.0 release ensured that the ServiceLoader lookup and subsequent cache was thread-safe, but not iteration of the ServiceLoader instance itself. We'll use this issue to track the work for making that thread-safe as well. cc @bdemers

[lhazlewood]

@icecreamhead not just yet, but we've started other work for a follow-up 0.12.4 release, and we can add this to that release. In the meantime, the solution in my #873 (comment) works.

[vojkny]

We just stumbled into the same issue, will appreciate the fix as well!

[bdemers]

We are looking into a fix, in the short term you can set the instance of the service, this will cause the ServiceLoader to NOT be used automatically

[lhazlewood]

As @bdemers said, at least until we have a longer term solution for this, you can disable dynamic lookup by explicitly setting the respective service instance as JwtBuilder and JwtParserBuilder properties per https://github.com/jwtk/jjwt#custom-json-processor

When they are explicitly provided, the builders don't need to perform dynamic lookup using ServiceLoader.

[icecreamhead]

Hi, are there any updates on this issue? We're also encountering the problem.

[lhazlewood]

Just to be clear, that looks like this (using Jackson for example):

Jwts.builder().json(new JacksonSerializer())...

or:

Jwts.parser().json(new JacksonDeserializer())...