You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "arashpreet0011 (via GitHub)" <gi...@apache.org> on 2025/03/03 12:09:59 UTC
[PR] OFBIZ-13212-framework-update [ofbiz-framework]
arashpreet0011 opened a new pull request, #881:
URL: https://github.com/apache/ofbiz-framework/pull/881
Implemented:
Modified framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/JWTManager.java to generate and validate refresh token.
Explanation:
This implementation will allow user to get refresh token while login.
(OFBIZ-13212)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] OFBIZ-13212-framework-update [ofbiz-framework]
Posted by "JacquesLeRoux (via GitHub)" <gi...@apache.org>.
JacquesLeRoux merged PR #881:
URL: https://github.com/apache/ofbiz-framework/pull/881
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] OFBIZ-13212-framework-update [ofbiz-framework]
Posted by "JacquesLeRoux (via GitHub)" <gi...@apache.org>.
JacquesLeRoux commented on code in PR #881:
URL: https://github.com/apache/ofbiz-framework/pull/881#discussion_r1985284086
##########
framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/JWTManager.java:
##########
@@ -404,4 +404,18 @@
}
return result;
}
+
+ public static String createRefreshToken(Delegator delegator, String userLoginId) {
+ int refreshTokenExpireTime = Integer.parseInt(EntityUtilProperties.getPropertyValue("security",
+ "security.jwt.refreshToken.expireTime", "86400", delegator));
Review Comment:
Already dismissed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] OFBIZ-13212-framework-update [ofbiz-framework]
Posted by "JacquesLeRoux (via GitHub)" <gi...@apache.org>.
JacquesLeRoux commented on PR #881:
URL: https://github.com/apache/ofbiz-framework/pull/881#issuecomment-2706140372
You need to add security.jwt.refreshToken.expireTime in security.properties.
I guess it's on your side, but not here ;)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] OFBIZ-13212-framework-update [ofbiz-framework]
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #881:
URL: https://github.com/apache/ofbiz-framework/pull/881#discussion_r1977448049
##########
framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/JWTManager.java:
##########
@@ -404,4 +404,18 @@
}
return result;
}
+
+ public static String createRefreshToken(Delegator delegator, String userLoginId) {
+ int refreshTokenExpireTime = Integer.parseInt(EntityUtilProperties.getPropertyValue("security",
+ "security.jwt.refreshToken.expireTime", "86400", delegator));
Review Comment:
## Insecure randomness
Potential Insecure randomness due to a [Insecure randomness source.](1).
[Show more details](https://github.com/apache/ofbiz-framework/security/code-scanning/1837)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] OFBIZ-13212-framework-update [ofbiz-framework]
Posted by "JacquesLeRoux (via GitHub)" <gi...@apache.org>.
JacquesLeRoux commented on PR #881:
URL: https://github.com/apache/ofbiz-framework/pull/881#issuecomment-2705885046
Don't worry about CodeQL failures. They exist for few weeks, are not related to us, so we ignore them for now and use those generated before.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] OFBIZ-13212-framework-update [ofbiz-framework]
Posted by "arashpreet0011 (via GitHub)" <gi...@apache.org>.
arashpreet0011 commented on PR #881:
URL: https://github.com/apache/ofbiz-framework/pull/881#issuecomment-2706190356
> You need to add security.jwt.refreshToken.expireTime in security.properties. I guess it's on your side, but not here ;)
I added property security.jwt.refresh.token.expireTime in security.properties file.
But expire time for createJwt method which is ofbiz default is also passed int the method as below -
`Integer.parseInt(EntityUtilProperties.getPropertyValue("security", "security.jwt.token.expireTime", "1800", delegator));`
In same way I added this property as below -
int refreshTokenExpireTime = Integer.parseInt(EntityUtilProperties.getPropertyValue("security",
"security.jwt.refresh.token.expireTime", "86400", delegator));
Below is latest commit -
https://github.com/apache/ofbiz-framework/commit/4383971767de4833026eece43a1a0b55c99b5cad
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] OFBIZ-13212-framework-update [ofbiz-framework]
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #881:
URL: https://github.com/apache/ofbiz-framework/pull/881#discussion_r1985290897
##########
framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/JWTManager.java:
##########
@@ -404,4 +404,18 @@
}
return result;
}
+
+ public static String createRefreshToken(Delegator delegator, String userLoginId) {
+ int refreshTokenExpireTime = Integer.parseInt(EntityUtilProperties.getPropertyValue("security",
+ "security.jwt.refresh.token.expireTime", "86400", delegator));
Review Comment:
## Insecure randomness
Potential Insecure randomness due to a [Insecure randomness source.](1).
[Show more details](https://github.com/apache/ofbiz-framework/security/code-scanning/1838)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] OFBIZ-13212-framework-update [ofbiz-framework]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #881:
URL: https://github.com/apache/ofbiz-framework/pull/881#issuecomment-2694167228
## [](https://sonarcloud.io/dashboard?id=apache_ofbiz-framework&pullRequest=881) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_ofbiz-framework&pullRequest=881&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_ofbiz-framework&pullRequest=881&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_ofbiz-framework&pullRequest=881&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_ofbiz-framework&pullRequest=881&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_ofbiz-framework&pullRequest=881&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_ofbiz-framework&pullRequest=881)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] OFBIZ-13212-framework-update [ofbiz-framework]
Posted by "arashpreet0011 (via GitHub)" <gi...@apache.org>.
arashpreet0011 commented on PR #881:
URL: https://github.com/apache/ofbiz-framework/pull/881#issuecomment-2705962672
> Hi @arashpreet0011,
>
> security.jwt.refreshToken.expireTime is missing. Why 86400 as default timeout?
While generating an access token, the default validity period is set to 1800 seconds (30 minutes). I have configured the refresh token validity to 86,400 seconds (24 hours) following the same approach, ensuring consistency in token expiration settings.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] OFBIZ-13212-framework-update [ofbiz-framework]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #881:
URL: https://github.com/apache/ofbiz-framework/pull/881#issuecomment-2706183896
## [](https://sonarcloud.io/dashboard?id=apache_ofbiz-framework&pullRequest=881) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_ofbiz-framework&pullRequest=881&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_ofbiz-framework&pullRequest=881&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_ofbiz-framework&pullRequest=881&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_ofbiz-framework&pullRequest=881&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_ofbiz-framework&pullRequest=881&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_ofbiz-framework&pullRequest=881)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org