This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/JwtAuthenticationClientFilter in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 8410316f1e74ed1001a912c312317a388c8c48f0 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Mon Aug 31 15:00:29 2026 +0100 Add default expiry for JwtAuthenticationClientFilter --- .../jose/jaxrs/JwtAuthenticationClientFilter.java | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java index 36237e70fef..03e32a017c6 100644 --- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java +++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java @@ -43,7 +43,12 @@ public class JwtAuthenticationClientFilter extends JoseJwtProducer implements ClientRequestFilter { private static final String DEFAULT_AUTH_SCHEME = "Bearer"; + // Bounds the lifetime of the credential-wrapping token built below; it is consumed + // within the same request round trip so a short-lived default is sufficient. + private static final int DEFAULT_TTL_SECS = 60; private String authScheme = DEFAULT_AUTH_SCHEME; + private int ttl = DEFAULT_TTL_SECS; + @Override public void filter(ClientRequestContext requestContext) throws IOException { JwtToken jwt = getJwtToken(requestContext); @@ -54,7 +59,11 @@ public class JwtAuthenticationClientFilter extends JoseJwtProducer JwtClaims claims = new JwtClaims(); claims.setSubject(ap.getUserName()); claims.setClaim("password", ap.getPassword()); - claims.setIssuedAt(System.currentTimeMillis() / 1000L); + long issuedAt = System.currentTimeMillis() / 1000L; + claims.setIssuedAt(issuedAt); + if (ttl > 0) { + claims.setExpiryTime(issuedAt + ttl); + } jwt = new JwtToken(new JweHeaders(), claims); } } @@ -100,6 +109,12 @@ public class JwtAuthenticationClientFilter extends JoseJwtProducer this.authScheme = authScheme; } + public int getTtl() { + return ttl; + } + public void setTtl(int ttl) { + this.ttl = ttl; + } }
