(cxf) branch main updated: Add default expiry for JwtAuthenticationClientFilter (#3422)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/main by this push:
     new 6298bc579a3 Add default expiry for JwtAuthenticationClientFilter 
(#3422)
6298bc579a3 is described below

commit 6298bc579a3dc5f6cf98a99b45946597328425d2
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Mon Aug 31 16:55:51 2026 +0100

    Add default expiry for JwtAuthenticationClientFilter (#3422)
---
 .../jose/jaxrs/JwtAuthenticationClientFilter.java       | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git 
a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java
 
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java
index 36237e70fef..03e32a017c6 100644
--- 
a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java
+++ 
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java
@@ -43,7 +43,12 @@ public class JwtAuthenticationClientFilter extends 
JoseJwtProducer
     implements ClientRequestFilter {
 
     private static final String DEFAULT_AUTH_SCHEME = "Bearer";
+    // Bounds the lifetime of the credential-wrapping token built below; it is 
consumed
+    // within the same request round trip so a short-lived default is 
sufficient.
+    private static final int DEFAULT_TTL_SECS = 60;
     private String authScheme = DEFAULT_AUTH_SCHEME;
+    private int ttl = DEFAULT_TTL_SECS;
+
     @Override
     public void filter(ClientRequestContext requestContext) throws IOException 
{
         JwtToken jwt = getJwtToken(requestContext);
@@ -54,7 +59,11 @@ public class JwtAuthenticationClientFilter extends 
JoseJwtProducer
                 JwtClaims claims = new JwtClaims();
                 claims.setSubject(ap.getUserName());
                 claims.setClaim("password", ap.getPassword());
-                claims.setIssuedAt(System.currentTimeMillis() / 1000L);
+                long issuedAt = System.currentTimeMillis() / 1000L;
+                claims.setIssuedAt(issuedAt);
+                if (ttl > 0) {
+                    claims.setExpiryTime(issuedAt + ttl);
+                }
                 jwt = new JwtToken(new JweHeaders(), claims);
             }
         }
@@ -100,6 +109,12 @@ public class JwtAuthenticationClientFilter extends 
JoseJwtProducer
         this.authScheme = authScheme;
     }
 
+    public int getTtl() {
+        return ttl;
+    }
 
+    public void setTtl(int ttl) {
+        this.ttl = ttl;
+    }
 
 }