Okta Introduces Java Library for PASETOs

Okta, an authentication solution provider, has announced a new Java developer library to streamline use of PASETOs. PASETOs (Platform Agnostic Security Tokens) reduce the scope of JavaScript Object Signing and Encryption (JOSE), but continues to provide the functionality needed to secure applications. PASETOs are said to be easier to use than JOSE or any JWT, with all the same security.

PASETO is a draft RFC spec. It defines two token types: local and public. Local tokens are symmetrically encrypted with a shared secret key (i.e. no one can view the contents of the local PASETO unless they have the correct key). Public tokens are readable by anyone with a validated public key. Nobody can access a token without a key.

Okta has developed an open-source PASETO library: JPaseto. It is Java-based, and is modeled off of the JJWT project. JJWT is the most popular JWT library for Java developers. JPaseto has the same feature set of JJWT in half the number of code lines.

JPasto is available on Maven central. You can also learn more at JPaseto on GitHub. Okta's blog post announcement provides more details on its functionality and how to get started.

Be sure to read the next Authentication article: GitHub Modifies Authentication Methods for REST API


Comments (0)