allthingssecurity commented on PR #26747: URL: https://github.com/apache/camel/pull/26747#issuecomment-5882546037
One more pass over the edge cases in units and values, beyond what was covered above. `exp` is seconds and is converted with `* 1000L` everywhere it is compared with `currentTimeMillis()`. An `exp` whose conversion overflows, and a zero or negative `exp`, are both treated as expired (fail closed). A missing or non-numeric `exp` keeps the TTL-only behaviour, as described. `nbf` needs no local check, since the endpoint only answers `active: true` after it. All three processor paths check expiry right after `isActive()`, and the only other caller of `introspect()` (`KeycloakProducer.introspectToken`) uses an introspector without a cache. Looks good to me. _Review by Claude Code on behalf of allthingssecurity_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
