[jira] [Created] (CXF-9232) Implement JTI/Assertion-ID replay cache for SAML and JWT bearer grants (Close //TODO)

["Guanping Zhang (Jira)" <ji...@apache.org>]

Guanping Zhang created CXF-9232:
-----------------------------------

             Summary: Implement JTI/Assertion-ID replay cache for SAML and JWT bearer grants (Close //TODO)
                 Key: CXF-9232
                 URL: https://issues.apache.org/jira/browse/CXF-9232
             Project: CXF
          Issue Type: Improvement
          Components: JAX-RS Security
    Affects Versions: 4.2.2
         Environment: Apache CXF 3.5.7 / 4.2.x, Java 11+.
            Reporter: Guanping Zhang


h3. Background
Following a discussion with the Apache CXF Security Team (security@apache.org), this issue is being tracked publicly as a security hardening improvement and technical debt resolution, aligning with the CXF Threat Model §14 (proposed replay protection controls).

h3. Problem Description
Currently, neither the SAML-bearer nor the JWT-bearer grant handlers in Apache CXF record the assertion identifier (or {{jti}}) in a replay cache. While the validators correctly enforce signature and expiry ({{NotOnOrAfter}} / {{exp}}), the absence of a single-use replay cache means that a captured, still-valid signed assertion can be redeemed multiple times within its validity window, with each redemption minting a fresh, independent access token. 

This deviates from the one-time-use semantics expected of bearer assertions per RFC 7521 §2.1 and RFC 7523.

h3. Root Cause & Code Locations
1. *SAML Bearer*: In {{SamlOAuthValidator.java}} (approx. line 160), there is an explicit unimplemented TODO left in the codebase:
{code:java}
//TODO: replay cache, same as with SAML SSO case
{code}

2. *JWT Bearer*: In {{AbstractJwtHandler.validateClaims()}}, the {{jti}} claim is never read, validated, or stored in a cache.

h3. Suggested Improvement
To provide integrators with a robust, out-of-the-box defense-in-depth mechanism (especially for environments where assertion capture is a concern), we should implement a single-use replay cache keyed on the assertion ID / {{jti}}. 

The SAML SSO path in CXF already utilizes a {{ONE_TIME_USE}} cache mechanism. This same caching infrastructure could be wired into the bearer grant validation paths to close the existing {{//TODO}} and enforce single-use semantics for both SAML and JWT bearer assertions.




--
This message was sent by Atlassian Jira
(v8.20.10#820010)