DefaultJWTClaimsVerifier not threadsafe

[Former user]

In com.nimbusds.jwt.proc.DefaultJWTClaimsVerifier there are two BadJWTException instances kept as constants.

The problem is that when an exception is throw a stacktrace is attached to it, making it a mutable object. There is a (extremely) small chance that two threads throw the same exception at the same instance and the stacktrace gets clobbered.

[Vladimir Dzhuvinov]

This likely was the case in a old version of the lib, the current 9.x doesn't have BadJWTException constants. There should be none at present.

If you run into similar issues, please post a snippet or link to the code line(s).