[jira] [Assigned] (CXF-9237) JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted

["Colm O hEigeartaigh (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CXF-9237?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Colm O hEigeartaigh reassigned CXF-9237:
----------------------------------------

    Assignee: Colm O hEigeartaigh

> JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries (incl. expired tokens) are never evicted
> --------------------------------------------------------------------------------------------------------------------
>
>                 Key: CXF-9237
>                 URL: https://issues.apache.org/jira/browse/CXF-9237
>             Project: CXF
>          Issue Type: Bug
>          Components: JAX-RS Security
>    Affects Versions: 3.6.8, 4.2.1
>         Environment: Apache CXF 3.6.8, Java 11+, JCache (JSR-107) backend (e.g. ehcache-107).
>            Reporter: Guanping Zhang
>            Assignee: Colm O hEigeartaigh
>            Priority: Major
>
> h3. Problem
> JCacheOAuthDataProvider.createCache() (lines 299-313) builds the client / accessToken / refreshToken caches with MutableConfiguration but never calls setExpiryPolicyFactory(). Under JSR-107 defaults, entries therefore never expire at the cache-infrastructure level. Eexpired tokens are removed by neither the application logic nor the cache infrastructure: they persist for the lifetime of the process.
> h3. Impact (operational, not a security-boundary bypass)
> Token introspection and refresh re-check expiry via OAuthUtils.isExpired, so expired tokens are still rejected at the security boundary; this defect therefore does not extend token validity. The impact is unbounded retention of expired entries — memory pressure / uncontrolled resource consumption (CWE-400) on long-lived authorization servers — and the defeat of any expectation of automatic eviction.
> h3. Suggested fix
> Configure a TTL on the caches, e.g.
> cfg.setExpiryPolicyFactory(CreatedExpiryPolicy.factoryOf(new Duration(TimeUnit.MILLISECONDS, tokenLifetime * 1000L)));
> (or an AccessedExpiryPolicy aligned with the token lifetime), so the cache infrastructure evicts expired entries independently of the application-level check.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)