This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/CXF-9223-main-only in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 05f1cdb817b4af44765d0ff6091cb615177571e9 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Thu Jul 23 14:04:26 2026 +0100 CXF-9223 - Disable audienceIsEndpointAddress on main only --- .../security/oauth2/filters/OAuthRequestFilter.java | 2 +- .../oauth2/filters/OAuthRequestFilterTest.java | 19 +++++++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilter.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilter.java index 72505c72130..f38f3ead660 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilter.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilter.java @@ -74,7 +74,7 @@ public class OAuthRequestFilter extends AbstractAccessTokenValidator private String audience; private String issuer; private boolean completeAudienceMatch; - private boolean audienceIsEndpointAddress = true; + private boolean audienceIsEndpointAddress; private boolean checkFormData; private List<String> requiredScopes = Collections.emptyList(); private boolean allPermissionsMatch; diff --git a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilterTest.java b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilterTest.java index 61da08c5a61..d52a148f8a4 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilterTest.java +++ b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilterTest.java @@ -83,9 +83,8 @@ public class OAuthRequestFilterTest { } @Test - public void testValidateAudiencesSkipsEndpointCheckWhenDisabled() { + public void testValidateAudiencesSkipsEndpointCheckByDefault() { OAuthRequestFilter filter = new OAuthRequestFilter(); - filter.setAudienceIsEndpointAddress(false); String result = filter.validateAudiences(Collections.singletonList("/api/read")); assertNull(result); @@ -105,6 +104,22 @@ public class OAuthRequestFilterTest { assertEquals("/api/read", result); } + @Test + public void testValidateAudiencesRequiresEndpointCheckEnabledForAudienceMatch() throws Exception { + OAuthRequestFilter filter = new OAuthRequestFilter(); + filter.setCompleteAudienceMatch(false); + + Message message = new MessageImpl(); + message.put(Message.REQUEST_URL, "/api/read/item"); + setThreadLocalMessage(message); + + // Default is disabled, so endpoint-address audience matching is skipped. + assertNull(filter.validateAudiences(Collections.singletonList("/api/read"))); + + filter.setAudienceIsEndpointAddress(true); + assertEquals("/api/read", filter.validateAudiences(Collections.singletonList("/api/read"))); + } + private static void setThreadLocalMessage(Message message) throws Exception { Field f = PhaseInterceptorChain.class.getDeclaredField("CURRENT_MESSAGE"); f.setAccessible(true);
