This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 3.6.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git

commit 0b58eaa87a07db06b138c265b77809e1427bd047
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Wed Jun 17 06:13:45 2026 +0100

    Make JCacheCodeDataProvider#removeCodeGrant atomic (#3224)
    
    (cherry picked from commit 3d6f726254c609bd2d1a00c14481d712019bd0ce)
    (cherry picked from commit 1facfe06b1169c4540839fe55c7be4fbe79c5750)
---
 .../cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
index 9d19d43a7c2..80085e35be9 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/JCacheCodeDataProvider.java
@@ -112,9 +112,9 @@ public class JCacheCodeDataProvider extends 
JCacheOAuthDataProvider
 
     @Override
     public ServerAuthorizationCodeGrant removeCodeGrant(String code) throws 
OAuthServiceException {
-        ServerAuthorizationCodeGrant grant = getCodeGrant(code);
-        if (grant != null) {
-            grantCache.remove(code);
+        ServerAuthorizationCodeGrant grant = grantCache.getAndRemove(code);
+        if (grant != null && isExpired(grant)) {
+            return null;
         }
         return grant;
     }

Reply via email to