(cxf) branch main updated: CXF-9223 - Disable audienceIsEndpointAddress on main only (#3332)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/main by this push:
     new 26dc065a7b6 CXF-9223 - Disable audienceIsEndpointAddress on main only 
(#3332)
26dc065a7b6 is described below

commit 26dc065a7b6c56ebe4515bc1ff9a74304b2f5b81
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Thu Jul 23 15:24:41 2026 +0100

    CXF-9223 - Disable audienceIsEndpointAddress on main only (#3332)
---
 .../security/oauth2/filters/OAuthRequestFilter.java   |  2 +-
 .../oauth2/filters/OAuthRequestFilterTest.java        | 19 +++++++++++++++++--
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilter.java
 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilter.java
index 72505c72130..f38f3ead660 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilter.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilter.java
@@ -74,7 +74,7 @@ public class OAuthRequestFilter extends 
AbstractAccessTokenValidator
     private String audience;
     private String issuer;
     private boolean completeAudienceMatch;
-    private boolean audienceIsEndpointAddress = true;
+    private boolean audienceIsEndpointAddress;
     private boolean checkFormData;
     private List<String> requiredScopes = Collections.emptyList();
     private boolean allPermissionsMatch;
diff --git 
a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilterTest.java
 
b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilterTest.java
index 61da08c5a61..d52a148f8a4 100644
--- 
a/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilterTest.java
+++ 
b/rt/rs/security/oauth-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/filters/OAuthRequestFilterTest.java
@@ -83,9 +83,8 @@ public class OAuthRequestFilterTest {
     }
 
     @Test
-    public void testValidateAudiencesSkipsEndpointCheckWhenDisabled() {
+    public void testValidateAudiencesSkipsEndpointCheckByDefault() {
         OAuthRequestFilter filter = new OAuthRequestFilter();
-        filter.setAudienceIsEndpointAddress(false);
 
         String result = 
filter.validateAudiences(Collections.singletonList("/api/read"));
         assertNull(result);
@@ -105,6 +104,22 @@ public class OAuthRequestFilterTest {
         assertEquals("/api/read", result);
     }
 
+    @Test
+    public void 
testValidateAudiencesRequiresEndpointCheckEnabledForAudienceMatch() throws 
Exception {
+        OAuthRequestFilter filter = new OAuthRequestFilter();
+        filter.setCompleteAudienceMatch(false);
+
+        Message message = new MessageImpl();
+        message.put(Message.REQUEST_URL, "/api/read/item");
+        setThreadLocalMessage(message);
+
+        // Default is disabled, so endpoint-address audience matching is 
skipped.
+        
assertNull(filter.validateAudiences(Collections.singletonList("/api/read")));
+
+        filter.setAudienceIsEndpointAddress(true);
+        assertEquals("/api/read", 
filter.validateAudiences(Collections.singletonList("/api/read")));
+    }
+
     private static void setThreadLocalMessage(Message message) throws 
Exception {
         Field f = 
PhaseInterceptorChain.class.getDeclaredField("CURRENT_MESSAGE");
         f.setAccessible(true);