This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/OidcRpAuthenticationFilter in repository https://gitbox.apache.org/repos/asf/cxf.git
commit cdde168196ebfa37391245f308d647a472c6fa75 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Mon Aug 31 17:30:03 2026 +0100 Require in OidcRpAuthenticationFilter that IdTokens have an expiry --- .../security/oidc/rp/OidcRpAuthenticationFilter.java | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java index e835252f81b..48aae736602 100644 --- a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java +++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java @@ -54,6 +54,7 @@ public class OidcRpAuthenticationFilter implements ContainerRequestFilter { private String redirectUri; private String roleClaim; private boolean addRequestUriAsRedirectQuery; + private boolean requireIdTokenExpiry = true; public void filter(ContainerRequestContext rc) { if (checkSecurityContext(rc)) { @@ -86,9 +87,13 @@ public class OidcRpAuthenticationFilter implements ContainerRequestFilter { return false; } IdToken idToken = tokenContext.getIdToken(); + if (idToken == null) { + return false; + } try { - // If ID token has expired then the context is no longer valid - JwtUtils.validateJwtExpiry(idToken, 0, idToken.getExpiryTime() != null); + // If ID token has expired then the context is no longer valid. + // OIDC Core mandates "exp" in ID Tokens, so it is required by default. + JwtUtils.validateJwtExpiry(idToken, 0, requireIdTokenExpiry); } catch (JwtException ex) { stateManager.removeClientTokenContext(new MessageContextImpl(JAXRSUtils.getCurrentMessage())); return false; @@ -153,4 +158,14 @@ public class OidcRpAuthenticationFilter implements ContainerRequestFilter { public void setAddRequestUriAsRedirectQuery(boolean addRequestUriAsRedirectQuery) { this.addRequestUriAsRedirectQuery = addRequestUriAsRedirectQuery; } + + /** + * Whether the stored ID token must carry an expiry ("exp") claim for the + * session context to keep being revalidated. Default is true. Disabling + * this re-opens never-expiring sessions for exp-less ID tokens - only do + * so if another mechanism bounds the session lifetime. + */ + public void setRequireIdTokenExpiry(boolean requireIdTokenExpiry) { + this.requireIdTokenExpiry = requireIdTokenExpiry; + } }
