This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch 3.6.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit c5ab6cbfde78f9127313cd5b7954fe83a63c5972 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Mon Aug 31 16:55:51 2026 +0100 Add default expiry for JwtAuthenticationClientFilter (#3422) (cherry picked from commit 6298bc579a3dc5f6cf98a99b45946597328425d2) --- .../jose/jaxrs/JwtAuthenticationClientFilter.java | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java index e194e130afc..460e8b27d5e 100644 --- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java +++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationClientFilter.java @@ -44,7 +44,12 @@ public class JwtAuthenticationClientFilter extends JoseJwtProducer implements ClientRequestFilter { private static final String DEFAULT_AUTH_SCHEME = "Bearer"; + // Bounds the lifetime of the credential-wrapping token built below; it is consumed + // within the same request round trip so a short-lived default is sufficient. + private static final int DEFAULT_TTL_SECS = 60; private String authScheme = DEFAULT_AUTH_SCHEME; + private int ttl = DEFAULT_TTL_SECS; + @Override public void filter(ClientRequestContext requestContext) throws IOException { JwtToken jwt = getJwtToken(requestContext); @@ -55,7 +60,11 @@ public class JwtAuthenticationClientFilter extends JoseJwtProducer JwtClaims claims = new JwtClaims(); claims.setSubject(ap.getUserName()); claims.setClaim("password", ap.getPassword()); - claims.setIssuedAt(System.currentTimeMillis() / 1000L); + long issuedAt = System.currentTimeMillis() / 1000L; + claims.setIssuedAt(issuedAt); + if (ttl > 0) { + claims.setExpiryTime(issuedAt + ttl); + } jwt = new JwtToken(new JweHeaders(), claims); } } @@ -101,6 +110,12 @@ public class JwtAuthenticationClientFilter extends JoseJwtProducer this.authScheme = authScheme; } + public int getTtl() { + return ttl; + } + public void setTtl(int ttl) { + this.ttl = ttl; + } }
