Source:
private void validateResponseJWT(HttpResponse response, String expectedTokenId) throws CommunicationErrorException, MarshallingError, InvalidResponseException, CryptographyError, InvalidCredentialsException { try { final String jwt = getJWT(response); String expected_audience; if (response.getStatusLine().getStatusCode() == 401) { expected_audience = "public"; } else { expected_audience = issuer.toString(); } final JWTClaims claims = validateJWT(expectedTokenId, jwt, expected_audience); HttpEntity entity = response.getEntity(); ByteArrayOutputStream stream = new ByteArrayOutputStream(); if (entity != null) entity.writeTo(stream); if (claims.getStatusCode() != response.getStatusLine().getStatusCode()) throw new JWTError("Status code of response content does not match JWT response status code", null); verifyContentHash(claims, stream, "response"); if ((response.containsHeader("Location") && !response.getFirstHeader("Location").getValue().equals(claims.getLocationHeader())) || (!response.containsHeader("Location") && claims.getLocationHeader() != null) ) throw new JWTError("Location header of response content does not match JWT response location", null); if ((response.containsHeader("Cache-Control") && !response.getFirstHeader("Cache-Control").getValue().equals(claims.getCacheControlHeader())) || (!response.containsHeader("Cache-Control") && claims.getCacheControlHeader() != null) ) throw new JWTError("Cache-Control header of response content does not match JWT response cache", null); } catch (JWTError jwtError) { throw new InvalidResponseException("Invalid JWT in response!", jwtError, null); } catch (NoSuchAlgorithmException | IOException e ) { throw new CryptographyError("An error occurred validating the body hash", e); } }

Target:
private void validateResponseJWT(HttpResponse response, String expectedTokenId) throws CommunicationErrorException, MarshallingError, InvalidResponseException, CryptographyError, InvalidCredentialsException { try { final String jwt = getJWT(response); String expectedAudience; if (response.getStatusLine().getStatusCode() == 401) { expectedAudience = "public"; } else { expectedAudience = issuer.toString(); } final JWTClaims claims = validateJWT(expectedTokenId, jwt, expectedAudience); HttpEntity entity = response.getEntity(); ByteArrayOutputStream stream = new ByteArrayOutputStream(); if (entity != null) entity.writeTo(stream); if (claims.getStatusCode() != response.getStatusLine().getStatusCode()) throw new JWTError("Status code of response content does not match JWT response status code", null); verifyContentHash(claims, stream, "response"); if ((response.containsHeader("Location") && !response.getFirstHeader("Location").getValue().equals(claims.getLocationHeader())) || (!response.containsHeader("Location") && claims.getLocationHeader() != null) ) throw new JWTError("Location header of response content does not match JWT response location", null); if ((response.containsHeader("Cache-Control") && !response.getFirstHeader("Cache-Control").getValue().equals(claims.getCacheControlHeader())) || (!response.containsHeader("Cache-Control") && claims.getCacheControlHeader() != null) ) throw new JWTError("Cache-Control header of response content does not match JWT response cache", null); } catch (JWTError jwtError) { throw new InvalidResponseException("Invalid JWT in response!", jwtError, null); } catch (NoSuchAlgorithmException | IOException e ) { throw new CryptographyError("An error occurred validating the body hash", e); } }