[PR] Fixed: JWT refresh tokens no longer accepted as access tokens (OFBIZ-13493) [ofbiz-framework]

["mridulpathak (via GitHub)" <gi...@apache.org>]

mridulpathak opened a new pull request, #1664:
URL: https://github.com/apache/ofbiz-framework/pull/1664

   createRefreshToken() signs refresh tokens with the same key as access tokens and a much longer expiration (24h vs 30min by default), but validateToken() never checked the "type" claim, so checkJWTLogin(), TokenFilter, and the REST API's APIAuthFilter all accepted a refresh token presented directly as a Bearer access credential, extending a leaked refresh token's usable window well beyond what the access-token lifetime is meant to allow. JWTManager.validateAccessToken() now rejects tokens with type: "refresh", and all three call sites use it instead of calling validateToken() directly. validateToken() and validateRefreshToken() are unchanged, so the refresh flow itself is unaffected.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fixed: JWT refresh tokens no longer accepted as access tokens (OFBIZ-13493) [ofbiz-framework]

["mridulpathak (via GitHub)" <gi...@apache.org>]

mridulpathak merged PR #1664:
URL: https://github.com/apache/ofbiz-framework/pull/1664


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org