You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2021/03/04 09:02:26 UTC
[syncope] branch 2_0_X updated: [SYNCOPE-1620] Consider exp and nbf
as optional during JWT validation
This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a commit to branch 2_0_X
in repository https://gitbox.apache.org/repos/asf/syncope.git
The following commit(s) were added to refs/heads/2_0_X by this push:
new da46888 [SYNCOPE-1620] Consider exp and nbf as optional during JWT validation
da46888 is described below
commit da468885e2a1f5d17106c15affdf18dd8924b52e
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Thu Mar 4 08:57:51 2021 +0100
[SYNCOPE-1620] Consider exp and nbf as optional during JWT validation
---
.../syncope/core/spring/security/JWTAuthenticationProvider.java | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationProvider.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationProvider.java
index 2741d86..db7b24e 100644
--- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationProvider.java
+++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationProvider.java
@@ -18,7 +18,6 @@
*/
package org.apache.syncope.core.spring.security;
-import java.util.Date;
import java.util.Set;
import org.apache.commons.lang3.tuple.Pair;
import org.apache.cxf.rs.security.jose.jwt.JwtClaims;
@@ -54,16 +53,16 @@ public class JWTAuthenticationProvider implements AuthenticationProvider {
});
JwtClaims claims = jwtAuthentication.getClaims();
- Long referenceTime = new Date().getTime();
+ long referenceTime = System.currentTimeMillis();
Long expiryTime = claims.getExpiryTime();
- if (expiryTime == null || (expiryTime * 1000L) < referenceTime) {
+ if (expiryTime != null && (expiryTime * 1000L) < referenceTime) {
dataAccessor.removeExpired(claims.getTokenId());
throw new CredentialsExpiredException("JWT is expired");
}
Long notBefore = claims.getNotBefore();
- if (notBefore == null || (notBefore * 1000L) > referenceTime) {
+ if (notBefore != null && (notBefore * 1000L) > referenceTime) {
throw new CredentialsExpiredException("JWT not valid yet");
}