This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch 3.6.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 0b58eaa87a07db06b138c265b77809e1427bd047 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Wed Jun 17 06:13:45 2026 +0100 Make JCacheCodeDataProvider#removeCodeGrant atomic (#3224) (cherry picked from commit 3d6f726254c609bd2d1a00c14481d712019bd0ce) (cherry picked from commit 1facfe06b1169c4540839fe55c7be4fbe79c5750) --- .../cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java index 9d19d43a7c2..80085e35be9 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java @@ -112,9 +112,9 @@ public class JCacheCodeDataProvider extends JCacheOAuthDataProvider @Override public ServerAuthorizationCodeGrant removeCodeGrant(String code) throws OAuthServiceException { - ServerAuthorizationCodeGrant grant = getCodeGrant(code); - if (grant != null) { - grantCache.remove(code); + ServerAuthorizationCodeGrant grant = grantCache.getAndRemove(code); + if (grant != null && isExpired(grant)) { + return null; } return grant; }
