(ofbiz-framework) branch release24.09 updated: Align securedLoginId cookie processing with JWT-based verification (#981)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

ashish pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 730ad7b15f Align securedLoginId cookie processing with JWT-based verification (#981)
730ad7b15f is described below

commit 730ad7b15fb288f4acfb04512872245eb6ac3343
Author: Ashish Vijaywargiya <as...@apache.org>
AuthorDate: Thu Mar 12 12:19:37 2026 +0530

    Align securedLoginId cookie processing with JWT-based verification (#981)
    
    Improved: Align securedLoginId cookie processing with JWT-based
    verification
    
    (cherry picked from commit 8c5af7e34b2348b94eeaacf4569a5b080b68f1a5)
---
 .../java/org/apache/ofbiz/webapp/control/LoginWorker.java     | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java
index 5f79634d01..3d11a2c94e 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java
@@ -1077,6 +1077,17 @@ public final class LoginWorker {
                 }
             }
         }
+
+        // Verify the plain-text cookie against the mathematically secure JWT token
+        if (UtilValidate.isNotEmpty(securedUserLoginId)) {
+            String jwtUserLoginId = getSecuredUserLoginByJWT(request);
+            if (UtilValidate.isEmpty(jwtUserLoginId) || !securedUserLoginId.equals(jwtUserLoginId)) {
+                Debug.logWarning("Cookie securedLoginId [" + securedUserLoginId
+                        + "] does not match or is missing a valid securedLoginToken JWT.", MODULE);
+                return null;
+            }
+        }
+
         return securedUserLoginId;
     }
     public static String getSecuredUserLoginByJWT(HttpServletRequest request) {