You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2026/08/31 15:58:42 UTC
(cxf) 02/02: Add default expiry for JwtAuthenticationClientFilter (#3422)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 8449b2b3158df14581d904844c80dda55854ce14
Author: Colm O hEigeartaigh <co...@users.noreply.github.com>
AuthorDate: Mon Aug 31 16:55:51 2026 +0100
Add default expiry for JwtAuthenticationClientFilter (#3422)
(cherry picked from commit 6298bc579a3dc5f6cf98a99b45946597328425d2)
---
.../jose/jaxrs/JwtAuthenticationClientFilter.java | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java
index 36237e70fef..03e32a017c6 100644
--- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java
+++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java
@@ -43,7 +43,12 @@ public class JwtAuthenticationClientFilter extends JoseJwtProducer
implements ClientRequestFilter {
private static final String DEFAULT_AUTH_SCHEME = "Bearer";
+ // Bounds the lifetime of the credential-wrapping token built below; it is consumed
+ // within the same request round trip so a short-lived default is sufficient.
+ private static final int DEFAULT_TTL_SECS = 60;
private String authScheme = DEFAULT_AUTH_SCHEME;
+ private int ttl = DEFAULT_TTL_SECS;
+
@Override
public void filter(ClientRequestContext requestContext) throws IOException {
JwtToken jwt = getJwtToken(requestContext);
@@ -54,7 +59,11 @@ public class JwtAuthenticationClientFilter extends JoseJwtProducer
JwtClaims claims = new JwtClaims();
claims.setSubject(ap.getUserName());
claims.setClaim("password", ap.getPassword());
- claims.setIssuedAt(System.currentTimeMillis() / 1000L);
+ long issuedAt = System.currentTimeMillis() / 1000L;
+ claims.setIssuedAt(issuedAt);
+ if (ttl > 0) {
+ claims.setExpiryTime(issuedAt + ttl);
+ }
jwt = new JwtToken(new JweHeaders(), claims);
}
}
@@ -100,6 +109,12 @@ public class JwtAuthenticationClientFilter extends JoseJwtProducer
this.authScheme = authScheme;
}
+ public int getTtl() {
+ return ttl;
+ }
+ public void setTtl(int ttl) {
+ this.ttl = ttl;
+ }
}