Best practice for validating JWT headers in NiFi

[#1]

We are working with Apache NiFi version 1.28 and need to validate JWT tokens that arrive as HTTP headers in FlowFiles created by the HandleHttpRequest processor. Once validated, the flow should continue to process the request; if invalid or expired, the request should be rejected.

I am aware that scripting options exist (e.g., ExecuteScript with Python/Groovy and JWT libraries), but I would like to know if there is a recommended or supported best practice within NiFi for handling JWT validation in this scenario.

Our use case is:

• Validate the JWT signature and claims against the JWKS endpoint provided by the identity provider.

• Extract claims for routing/authorization decisions.

• Reject invalid or expired tokens before further processing.
  

Any guidance on the best way to implement this securely and efficiently would be greatly appreciated.
@MattWho 

[#2]

@Krish98 

Unfortunately, I have no "Best Practice" recommendation for the use case you have shared.  It is not a use case I have ever setup before.


Also want to share that in Apache NiFi 2.4+ version a new JWTBearerOAuth2AccessTokenProvider controller service was introduced. 
While not a solution to you query, I wanted to share this with you. 

Apache NiFi jira: NIFI-14380

NOTE: The Apache NiFi 1.x major release line is End-Of-Life now.  There will be no future releases of the 1. major release line.  There is no direct upgrade path from Apache NiFi 1.x to Apache NiFi 2.x.  You'll need to migrate your dataflows from 1.x to 2.x.

For our Cloudera Flow Management licensed users, we provide tooling to assist with migrating dataflows from Flow Management versions based on Apache NiFi 1.x to Flow Management versions based on Apache NiFi 2.x.   Cloudera Flow Management 2.x also includes many of the components deprecated and no longer included in the Apache NiFi 2.x release line. 


Thank you,
Matt