Consider renaming spring-security-jwt-jose

[rwinch]

Summary

Perhaps just spring-security-oauth2-jwt or spring-security-jwt or spring-security-jose or spring-security-oauth2-jose

If necessary we should also consider renaming packages to align with the new jar

[jgrandja]

Although JWT claims are typically used within the payload of a JWS, it's not a requirement that a JWS contain JWT defined claims or be a JSON, as stated in Section 3.3 Example JWS

The UTF-8 representation of the following JSON object is used as the
JWS Payload. (Note that the payload can be any content and need not
be a representation of a JSON object.)

JWS represents digitally signed or MACed content using a JSON data structure but does not constrict it to be a JSON object only.

The same rules apply for a JWE - JWE represents encrypted content using JSON data structures.

I feel the current module name spring-security-jwt-jose is correct.

The package org.springframework.security.jwt defines JWT constructs and the JOSE framework constructs would be defined in:

org.springframework.security.jose.jws
org.springframework.security.jose.jwe
org.springframework.security.jose.jwa

@rwinch Does this make sense?

[rwinch]

Without cryptography JOSE JWT is an abstract concept. JWT is really an encrypted or signed JWT which means it is part of JOSE or uses JOSE.

There is alg=none, but at this point you just have JSON and no security which means in a security framework we should probably not allow alg=none.

I don't like having a jar that is doing two different things. It should have a unified single purpose. So if it is a separate concept, I think we need to move to multiple jars (don't like that). If there is a single purpose already, the jar name should fit that (I think spring-security-oauth2-jose works).

[jgrandja]

The main purpose of this module is for JWS and JWE. And given that we're only dealing with a signed JWT (JWS) or encrypted JWT (JWE) than JWT is redundant in the module name.

I'm good with the proposed spring-security-oauth2-jose module name.