You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2026/08/31 16:30:27 UTC
(cxf) branch coheigea/OidcRpAuthenticationFilter created (now cdde168196e)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch coheigea/OidcRpAuthenticationFilter
in repository https://gitbox.apache.org/repos/asf/cxf.git
at cdde168196e Require in OidcRpAuthenticationFilter that IdTokens have an expiry
This branch includes the following new commits:
new cdde168196e Require in OidcRpAuthenticationFilter that IdTokens have an expiry
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(cxf) 01/01: Require in OidcRpAuthenticationFilter that IdTokens have an expiry
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch coheigea/OidcRpAuthenticationFilter
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit cdde168196ebfa37391245f308d647a472c6fa75
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Mon Aug 31 17:30:03 2026 +0100
Require in OidcRpAuthenticationFilter that IdTokens have an expiry
---
.../security/oidc/rp/OidcRpAuthenticationFilter.java | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
index e835252f81b..48aae736602 100644
--- a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
+++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
@@ -54,6 +54,7 @@ public class OidcRpAuthenticationFilter implements ContainerRequestFilter {
private String redirectUri;
private String roleClaim;
private boolean addRequestUriAsRedirectQuery;
+ private boolean requireIdTokenExpiry = true;
public void filter(ContainerRequestContext rc) {
if (checkSecurityContext(rc)) {
@@ -86,9 +87,13 @@ public class OidcRpAuthenticationFilter implements ContainerRequestFilter {
return false;
}
IdToken idToken = tokenContext.getIdToken();
+ if (idToken == null) {
+ return false;
+ }
try {
- // If ID token has expired then the context is no longer valid
- JwtUtils.validateJwtExpiry(idToken, 0, idToken.getExpiryTime() != null);
+ // If ID token has expired then the context is no longer valid.
+ // OIDC Core mandates "exp" in ID Tokens, so it is required by default.
+ JwtUtils.validateJwtExpiry(idToken, 0, requireIdTokenExpiry);
} catch (JwtException ex) {
stateManager.removeClientTokenContext(new MessageContextImpl(JAXRSUtils.getCurrentMessage()));
return false;
@@ -153,4 +158,14 @@ public class OidcRpAuthenticationFilter implements ContainerRequestFilter {
public void setAddRequestUriAsRedirectQuery(boolean addRequestUriAsRedirectQuery) {
this.addRequestUriAsRedirectQuery = addRequestUriAsRedirectQuery;
}
+
+ /**
+ * Whether the stored ID token must carry an expiry ("exp") claim for the
+ * session context to keep being revalidated. Default is true. Disabling
+ * this re-opens never-expiring sessions for exp-less ID tokens - only do
+ * so if another mechanism bounds the session lifetime.
+ */
+ public void setRequireIdTokenExpiry(boolean requireIdTokenExpiry) {
+ this.requireIdTokenExpiry = requireIdTokenExpiry;
+ }
}