(cxf) branch 4.1.x-fixes updated: Make JCacheCodeDataProvider#removeCodeGrant atomic (#3224)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/4.1.x-fixes by this push:
     new 1facfe06b11 Make JCacheCodeDataProvider#removeCodeGrant atomic (#3224)
1facfe06b11 is described below

commit 1facfe06b1169c4540839fe55c7be4fbe79c5750
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Wed Jun 17 06:13:45 2026 +0100

    Make JCacheCodeDataProvider#removeCodeGrant atomic (#3224)
    
    (cherry picked from commit 3d6f726254c609bd2d1a00c14481d712019bd0ce)
---
 .../cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
index ed9d9823a82..e84fbcfd9b3 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
@@ -111,9 +111,9 @@ public class JCacheCodeDataProvider extends 
JCacheOAuthDataProvider
 
     @Override
     public ServerAuthorizationCodeGrant removeCodeGrant(String code) throws 
OAuthServiceException {
-        ServerAuthorizationCodeGrant grant = getCodeGrant(code);
-        if (grant != null) {
-            grantCache.remove(code);
+        ServerAuthorizationCodeGrant grant = grantCache.getAndRemove(code);
+        if (grant != null && isExpired(grant)) {
+            return null;
         }
         return grant;
     }