light-4j 1.6.x : Add option to allow JWTVerifyHandler to skip token validation

[mihai-vladuc]

Add a new property "skipSignatureAndExpirationCheck" with a default value of false to security.yml. When skipSignatureAndExpirationCheck is true, then add code to skip token validation – and ONLY skip token validation... JWTVerifier must still execute ALL OTHER existing functions.

[stevehu]

@mihai-vladuc I am assuming that the change can help the developers skip the token validation in the early stage of the application development. If that is the case, should we backport the skipPathPrefixes to 1.6.x branch? It is more visible and easily to be removed when deploying to higher environments. What do you think?

[mihai-vladuc]

@stevehu This issue was opened with a specific business case in mind: to skip token “signature” and “expiration”. But we need others token functionalities, such as the “claims”. We don’t want to totally skip the token functionality.
We’ll keep in mind “skipPathPrefixes” configuration parameter and we’ll be opening another issue for that if we'll need it. Thank You !