== How to fix it in Nimbus

=== Code examples

include::../../common/fix/code-rationale.adoc[]

==== Noncompliant code example

[source,java,diff-id=21,diff-type=noncompliant]
----
import com.nimbusds.jwt.PlainJWT;

public void encode(JWTClaimsSet claimsSet) {
    PlainJWT jwt = new PlainJWT(claimsSet); // Noncompliant
}
----

[source,java,diff-id=22,diff-type=noncompliant]
----
import com.nimbusds.jwt.PlainJWT;

public void decode(String jwtString) {
    PlainJWT jwt = PlainJWT.parse(jwtString); // Noncompliant
}
----

==== Compliant solution

[source,java,diff-id=21,diff-type=compliant]
----
import com.nimbusds.jwt.SignedJWT;

public void encode(JWTClaimsSet claimsSet) {
    SignedJWT jwt = new SignedJWT(new JWSHeader(JWSAlgorithm.HS256), claimsSet);
    jwt.sign(new MACSigner(sharedSecret));
}
----

[source,java,diff-id=22,diff-type=compliant]
----
import com.nimbusds.jwt.SignedJWT;

public void decode(String jwtString) {
    SignedJWT jwt = SignedJWT.parse(jwtString);

    if (!jwt.verify(new MACVerifier(sharedSecret))) {
        throw new JOSEException("JWT signature does not match");
    }
}
----

=== How does this work?

include::../../common/fix/encode.adoc[]

include::../../common/fix/decode.adoc[]

=== Going the extra mile

include::../../common/extra-mile/key-storage.adoc[]

include::../../common/extra-mile/key-rotation.adoc[]