You are viewing a plain text version of this content. The canonical link for it is here.
- [jira] [Updated] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( - posted by "Valentino Porta (Jira)" <ji...@apache.org> on 2026/08/01 14:39:00 UTC, 2 replies.
- [jira] [Commented] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( - posted by "Valentino Porta (Jira)" <ji...@apache.org> on 2026/08/01 15:04:00 UTC, 2 replies.
- [jira] [Comment Edited] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( - posted by "Valentino Porta (Jira)" <ji...@apache.org> on 2026/08/01 15:42:00 UTC, 0 replies.
- [jira] [Created] (CXF-9235) set.content.type.for.empty.request seems to be ignored in DELETE request - posted by "Neena Jacob (Jira)" <ji...@apache.org> on 2026/08/05 05:24:00 UTC, 0 replies.
- [jira] [Updated] (CXF-9235) set.content.type.for.empty.request seems to be ignored in DELETE request - posted by "Neena Jacob (Jira)" <ji...@apache.org> on 2026/08/05 05:26:00 UTC, 3 replies.
- [jira] [Updated] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request - posted by "Neena Jacob (Jira)" <ji...@apache.org> on 2026/08/05 06:19:00 UTC, 3 replies.
- [jira] [Commented] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request - posted by "Neena Jacob (Jira)" <ji...@apache.org> on 2026/08/05 06:23:00 UTC, 3 replies.
- [jira] [Resolved] (CXF-9234) Concurrent DynamicClientFactory.createClient for the same WSDL url corrupts the cached schema DOM and spins forever at 100% CPU - posted by "Freeman Yue Fang (Jira)" <ji...@apache.org> on 2026/08/05 21:08:00 UTC, 0 replies.
- [jira] [Comment Edited] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request - posted by "Freeman Yue Fang (Jira)" <ji...@apache.org> on 2026/08/05 21:56:00 UTC, 2 replies.
- [jira] [Commented] (CXF-9221) JCache providers use inverted isExpired() logic causing expired tokens/codes to never be evicted - posted by "Guanping Zhang (Jira)" <ji...@apache.org> on 2026/08/09 14:37:00 UTC, 1 replies.
- [jira] [Created] (CXF-9236) Hawk validator: nonce/replay protection silently disabled by default (NonceVerifier never wired) — fail closed or auto-wire - posted by "Guanping Zhang (Jira)" <ji...@apache.org> on 2026/08/09 14:45:00 UTC, 0 replies.
- [jira] [Created] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted - posted by "Guanping Zhang (Jira)" <ji...@apache.org> on 2026/08/09 14:51:00 UTC, 0 replies.
- [jira] [Updated] (CXF-9236) Hawk validator: nonce/replay protection silently disabled by default (NonceVerifier never wired) — fail closed or auto-wire - posted by "Guanping Zhang (Jira)" <ji...@apache.org> on 2026/08/09 14:52:00 UTC, 0 replies.
- [jira] [Created] (CXF-9238) AbstractAccessTokenValidator validation cache evicts ALL entries via clear() on overflow — replace with LRU to avoid cache-thrash - posted by "Guanping Zhang (Jira)" <ji...@apache.org> on 2026/08/10 13:44:00 UTC, 0 replies.
- [jira] [Created] (CXF-9239) JoseSessionTokenProvider accepts JWE-only (no JWS) session tokens — enforce encrypt-then-sign or warn/document the integrity gap - posted by "Guanping Zhang (Jira)" <ji...@apache.org> on 2026/08/10 13:48:00 UTC, 0 replies.
- [jira] [Created] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses - posted by "Guanping Zhang (Jira)" <ji...@apache.org> on 2026/08/10 13:55:00 UTC, 0 replies.
- [jira] [Assigned] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/12 08:55:00 UTC, 0 replies.
- [jira] [Updated] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/12 08:58:00 UTC, 1 replies.
- [jira] [Resolved] (CXF-9240) OAuthJSONProvider.appendJsonPair() does not escape JSON string values — output injection / malformed JSON in introspect & token responses - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/13 08:37:00 UTC, 0 replies.
- [jira] [Assigned] (CXF-9239) JoseSessionTokenProvider accepts JWE-only (no JWS) session tokens — enforce encrypt-then-sign or warn/document the integrity gap - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/13 09:19:00 UTC, 0 replies.
- [jira] [Resolved] (CXF-9239) JoseSessionTokenProvider accepts JWE-only (no JWS) session tokens — enforce encrypt-then-sign or warn/document the integrity gap - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/13 09:20:00 UTC, 0 replies.
- [jira] [Assigned] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/13 09:23:00 UTC, 1 replies.
- [jira] [Updated] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/13 10:29:00 UTC, 1 replies.
- [jira] [Commented] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/13 15:06:00 UTC, 0 replies.
- [jira] [Created] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow - posted by "Guanping Zhang (Jira)" <ji...@apache.org> on 2026/08/13 15:26:00 UTC, 0 replies.
- [jira] [Assigned] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( - posted by "Andriy Redko (Jira)" <ji...@apache.org> on 2026/08/13 22:15:00 UTC, 0 replies.
- [jira] [Assigned] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request - posted by "Freeman Yue Fang (Jira)" <ji...@apache.org> on 2026/08/14 13:51:00 UTC, 0 replies.
- [jira] [Created] (CXF-9242) JwtAccessTokenValidator accepts absent `typ` header; OIDC IdP issues id_tokens without `typ`, enabling token confusion in misconfigured RS - posted by "Guanping Zhang (Jira)" <ji...@apache.org> on 2026/08/16 03:17:00 UTC, 0 replies.
- [jira] [Created] (CXF-9243) AuthorizationCodeGrantHandler consumes (burns) authorization code before performing validation (PKCE/redirect_uri), causing availability DoS on legitimate retries - posted by "Guanping Zhang (Jira)" <ji...@apache.org> on 2026/08/16 03:19:00 UTC, 0 replies.
- [jira] [Resolved] (CXF-9235) Invocation.Builder.property() settings ignored by HTTP transport for set.content.type.for.empty.request - posted by "Freeman Yue Fang (Jira)" <ji...@apache.org> on 2026/08/18 14:28:00 UTC, 0 replies.
- [jira] [Updated] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/21 16:06:00 UTC, 1 replies.
- [jira] [Assigned] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/21 16:06:00 UTC, 0 replies.
- [jira] [Created] (CXF-9244) Remove Hawk functionality - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/21 16:17:00 UTC, 0 replies.
- [jira] [Closed] (CXF-9236) Hawk validator: nonce/replay protection silently disabled by default (NonceVerifier never wired) — fail closed or auto-wire - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/21 16:19:00 UTC, 0 replies.
- [jira] [Resolved] (CXF-9241) ImplicitConfidentialGrantService violates RFC 6749 §4.2.2 by issuing Refresh Tokens in the Implicit Flow - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/24 08:08:00 UTC, 0 replies.
- [jira] [Resolved] (CXF-9233) AbstractLoggingInterceptor.LIVE_LOGGING_PROP already set in the message properties, so RESP_OUT log is disable :( - posted by "Andriy Redko (Jira)" <ji...@apache.org> on 2026/08/24 22:59:00 UTC, 0 replies.
- [jira] [Commented] (CXF-8913) Avoid 3rd party maven repository for OpenSAML - posted by "Thomas Beckers (Jira)" <ji...@apache.org> on 2026/08/25 14:51:00 UTC, 3 replies.
- [jira] [Resolved] (CXF-8913) Avoid 3rd party maven repository for OpenSAML - posted by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/08/25 16:13:00 UTC, 0 replies.
- [jira] [Created] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() - posted by "Benjamin Marwell (Jira)" <ji...@apache.org> on 2026/08/31 12:16:00 UTC, 0 replies.
- [jira] [Assigned] (CXF-9245) Race Condition in ServerLifeCycleManagerImpl#stopServer() - posted by "Andriy Redko (Jira)" <ji...@apache.org> on 2026/08/31 18:46:00 UTC, 0 replies.