This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/main by this push:
new d462fe0aad5 CXF-9221: JCache providers use inverted isExpired() logic
causing expired tokens/codes to never be evicted (#3240)
d462fe0aad5 is described below
commit d462fe0aad51657a15bd063da1b5cc5adea59c39
Author: Andriy Redko <[email protected]>
AuthorDate: Wed Jun 24 09:25:41 2026 -0400
CXF-9221: JCache providers use inverted isExpired() logic causing expired
tokens/codes to never be evicted (#3240)
---
.../oauth2/grants/code/JCacheCodeDataProvider.java | 3 +-
.../oauth2/provider/JCacheOAuthDataProvider.java | 3 +-
.../grants/code/JCacheCodeDataProviderTest.java | 26 ++++++++++++++++++
.../provider/JCacheOAuthDataProviderTest.java | 32 ++++++++++++++++++++++
4 files changed, 62 insertions(+), 2 deletions(-)
diff --git
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
index e84fbcfd9b3..80085e35be9 100644
---
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
+++
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
@@ -32,6 +32,7 @@ import org.apache.cxf.rs.security.oauth2.common.Client;
import org.apache.cxf.rs.security.oauth2.common.UserSubject;
import org.apache.cxf.rs.security.oauth2.provider.JCacheOAuthDataProvider;
import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthUtils;
public class JCacheCodeDataProvider extends JCacheOAuthDataProvider
implements AuthorizationCodeDataProvider {
@@ -133,7 +134,7 @@ public class JCacheCodeDataProvider extends
JCacheOAuthDataProvider
}
protected static boolean isExpired(ServerAuthorizationCodeGrant grant) {
- return System.currentTimeMillis() < (grant.getIssuedAt() +
grant.getExpiresIn());
+ return OAuthUtils.isExpired(grant.getIssuedAt(), grant.getExpiresIn());
}
@Override
diff --git
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/JCacheOAuthDataProvider.java
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/JCacheOAuthDataProvider.java
index 264915cfd94..c3e63c3c38a 100644
---
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/JCacheOAuthDataProvider.java
+++
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/JCacheOAuthDataProvider.java
@@ -39,6 +39,7 @@ import
org.apache.cxf.rs.security.oauth2.common.ServerAccessToken;
import org.apache.cxf.rs.security.oauth2.common.UserSubject;
import org.apache.cxf.rs.security.oauth2.tokens.refresh.RefreshToken;
import org.apache.cxf.rs.security.oauth2.utils.JwtTokenUtils;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthUtils;
import static org.apache.cxf.jaxrs.utils.ResourceUtils.getClasspathResourceURL;
@@ -274,7 +275,7 @@ public class JCacheOAuthDataProvider extends
AbstractOAuthDataProvider {
}
protected static boolean isExpired(ServerAccessToken token) {
- return System.currentTimeMillis() < (token.getIssuedAt() +
token.getExpiresIn());
+ return OAuthUtils.isExpired(token.getIssuedAt(), token.getExpiresIn());
}
protected static CacheManager createCacheManager(String configFile, Bus
bus) {
diff --git
a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProviderTest.java
b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProviderTest.java
index 9921d788301..904aa64041c 100644
---
a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProviderTest.java
+++
b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProviderTest.java
@@ -87,6 +87,32 @@ public class JCacheCodeDataProviderTest {
assertNotNull(grants);
assertEquals(0, grants.size());
}
+
+ @Test
+ public void testAddGetExpiredCodeGrants() throws InterruptedException {
+ Client c = addClient("111", "bob");
+
+ AuthorizationCodeRegistration atr = new
AuthorizationCodeRegistration();
+ atr.setClient(c);
+ atr.setApprovedScope(Collections.singletonList("a"));
+ atr.setSubject(c.getResourceOwnerSubject());
+
+ provider.setCodeLifetime(2 /* 2 seconds */);
+ provider.createCodeGrant(atr);
+
+ List<ServerAuthorizationCodeGrant> grants = provider.getCodeGrants(c,
c.getResourceOwnerSubject());
+ assertNotNull(grants);
+ assertEquals(1, grants.size());
+
+ Thread.sleep(3000); /* 3 seconds, grant definitely expires */
+ grants = provider.getCodeGrants(c, c.getResourceOwnerSubject());
+ assertEquals(0, grants.size());
+
+ provider.removeClient(c.getClientId());
+ grants = provider.getCodeGrants(c, c.getResourceOwnerSubject());
+ assertNotNull(grants);
+ assertEquals(0, grants.size());
+ }
private Client addClient(String clientId, String userLogin) {
Client c = new Client();
diff --git
a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/provider/JCacheOAuthDataProviderTest.java
b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/provider/JCacheOAuthDataProviderTest.java
index a63d12f55ef..1b2cfc98e2a 100644
---
a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/provider/JCacheOAuthDataProviderTest.java
+++
b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/provider/JCacheOAuthDataProviderTest.java
@@ -18,7 +18,18 @@
*/
package org.apache.cxf.rs.security.oauth2.provider;
+import java.util.Collections;
+import java.util.List;
+
+import org.apache.cxf.rs.security.oauth2.common.AccessTokenRegistration;
+import org.apache.cxf.rs.security.oauth2.common.Client;
+import org.apache.cxf.rs.security.oauth2.common.ServerAccessToken;
+
import org.junit.Before;
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
public class JCacheOAuthDataProviderTest extends AbstractOAuthDataProviderTest
{
@@ -29,4 +40,25 @@ public class JCacheOAuthDataProviderTest extends
AbstractOAuthDataProviderTest {
setProvider(provider);
}
+ @Test
+ public void testAddGetExpiredAccessToken() throws InterruptedException {
+ Client c = addClient("102", "bob");
+
+ AccessTokenRegistration atr = new AccessTokenRegistration();
+ atr.setClient(c);
+ atr.setApprovedScope(Collections.singletonList("a"));
+ atr.setSubject(c.getResourceOwnerSubject());
+
+ getProvider().setAccessTokenLifetime(2 /* 2 seconds */);
+ getProvider().createAccessToken(atr);
+ List<ServerAccessToken> tokens = getProvider().getAccessTokens(c,
null);
+ assertNotNull(tokens);
+ assertEquals(1, tokens.size());
+
+ Thread.sleep(3000); /* 3 seconds, token definitely expires */
+ tokens = getProvider().getAccessTokens(c, null);
+ assertEquals(0, tokens.size());
+
+ getProvider().removeClient(c.getClientId());
+ }
}
