Improve authoritiesClaimName validation in JwtGrantedAuthoritiesConverter

[chanbinme]

Summary

Use StringUtils.hasText() instead of null check in getAuthoritiesClaimName() to properly handle empty strings and whitespace-only strings.

Problem

The current null check (!= null) incorrectly treats empty strings ("") and whitespace-only strings (" ") as valid claim names. While setAuthoritiesClaimName() validates with Assert.hasText(), the field can be set through other means (reflection, constructors, etc.) that bypass this validation.

Changes

• Replace != null check with StringUtils.hasText()
• Add comprehensive test coverage for blank claim names

Testing

Added parameterized tests covering empty strings, whitespace strings, and null values using ReflectionTestUtils to simulate edge cases.

Impact

• Fixes edge case bugs with blank claim names
• Maintains full backward compatibility
• Follows defensive programming principles
• All existing tests pass

This is a straightforward bug fix that improves robustness without breaking changes.

[jzheaux]

Thanks for the PR, @chanbinme! I've left my feedback inline.

[jzheaux]

Instead of continuing to check for null, let's remove the null check by doing the following:

1. Change the authoritiesClaimName to Collection<String> authoritiesClaimNames = WELL_KNOWN_AUTHORITIES_CLAIM_NAMES;
2. Change setAuthoritiesClaimName to set this.authoritiesClaimNames to a single value
3. Replace the for loop to use this.authoritiesClaimNames
4. Remove the null check

In this way, authoritiesClaimNames can never contain an empty claim name.

[chanbinme]

Hi @jzheaux,

I've implemented the refactoring as suggested, but I noticed an important behavioral difference that I wanted to discuss:

Original behavior:

• When authoritiesClaimName is explicitly set → return it directly without JWT validation
• When using default claim names → return the first claim name that exists in the JWT

Initial refactoring attempt:

• All claim names go through JWT validation, which changes the behavior for explicitly set claim names

My solution:
To preserve the original behavior, I added an isExplicitlySet flag that tracks whether the claim name was explicitly configured. This ensures:

• Explicitly set claim names are returned without JWT validation (original behavior)
• Default claim names are validated against the JWT (original behavior)
• Null checks are eliminated since authoritiesClaimNames is always initialized

Would you prefer this approach, or would you like to intentionally change the behavior to always validate claim names against the JWT? I wanted to confirm the intended behavior before finalizing the implementation.

The changes include:

1. ✅ Changed authoritiesClaimName to Collection<String> authoritiesClaimNames
2. ✅ Updated setAuthoritiesClaimName to use Collections.singletonList()
3. ✅ Modified the for loop to use this.authoritiesClaimNames
4. ✅ Removed null checks
5. ➕ Added isExplicitlySet flag to preserve original behavior

Let me know your thoughts on this approach!

[chanbinme]

Hi @jzheaux,

Thank you so much for your helpful feedback!
I've incorporated your suggestions and pushed the changes.
When you have a moment, could you please take another look?
I've also left some comments on the inline feedback for further discussion.

Thanks again for your time and support!