This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch 3.6.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 239549beebbb3736aded5f49462936621e362015 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Fri May 22 09:43:49 2026 +0100 Synchronize access token refresh when refresh tokens aren't recycled (#3133) (cherry picked from commit 013cf51c68dfdfbc1290edeb71c9ef4aef4d4a22) (cherry picked from commit 9c214771a960cbb6303113149ffc7b964194c42c) --- .../rs/security/oauth2/provider/AbstractOAuthDataProvider.java | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java index 7c4ec37e246..5767dbe47b2 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java @@ -225,6 +225,16 @@ public abstract class AbstractOAuthDataProvider implements OAuthDataProvider, Cl @Override public ServerAccessToken refreshAccessToken(Client client, String refreshTokenKey, List<String> restrictedScopes) throws OAuthServiceException { + if (!recycleRefreshTokens) { + synchronized (refreshTokenLock) { + return doRefreshAccessToken(client, refreshTokenKey, restrictedScopes); + } + } + return doRefreshAccessToken(client, refreshTokenKey, restrictedScopes); + } + + private ServerAccessToken doRefreshAccessToken(Client client, String refreshTokenKey, + List<String> restrictedScopes) { RefreshToken currentRefreshToken = recycleRefreshTokens ? revokeRefreshToken(client, refreshTokenKey) : getRefreshToken(refreshTokenKey); if (currentRefreshToken == null) {
