(cxf) branch main updated: Require in OidcRpAuthenticationFilter that IdTokens have an expiry (#3424)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/main by this push:
     new 639cb574be2 Require in OidcRpAuthenticationFilter that IdTokens have 
an expiry (#3424)
639cb574be2 is described below

commit 639cb574be237b0ba9f3228c35c48008739b5b7e
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Tue Sep 1 08:28:00 2026 +0100

    Require in OidcRpAuthenticationFilter that IdTokens have an expiry (#3424)
---
 .../security/oidc/rp/OidcRpAuthenticationFilter.java  | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git 
a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
 
b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
index e835252f81b..48aae736602 100644
--- 
a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
+++ 
b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java
@@ -54,6 +54,7 @@ public class OidcRpAuthenticationFilter implements 
ContainerRequestFilter {
     private String redirectUri;
     private String roleClaim;
     private boolean addRequestUriAsRedirectQuery;
+    private boolean requireIdTokenExpiry = true;
 
     public void filter(ContainerRequestContext rc) {
         if (checkSecurityContext(rc)) {
@@ -86,9 +87,13 @@ public class OidcRpAuthenticationFilter implements 
ContainerRequestFilter {
             return false;
         }
         IdToken idToken = tokenContext.getIdToken();
+        if (idToken == null) {
+            return false;
+        }
         try {
-            // If ID token has expired then the context is no longer valid
-            JwtUtils.validateJwtExpiry(idToken, 0, idToken.getExpiryTime() != 
null);
+            // If ID token has expired then the context is no longer valid.
+            // OIDC Core mandates "exp" in ID Tokens, so it is required by 
default.
+            JwtUtils.validateJwtExpiry(idToken, 0, requireIdTokenExpiry);
         } catch (JwtException ex) {
             stateManager.removeClientTokenContext(new 
MessageContextImpl(JAXRSUtils.getCurrentMessage()));
             return false;
@@ -153,4 +158,14 @@ public class OidcRpAuthenticationFilter implements 
ContainerRequestFilter {
     public void setAddRequestUriAsRedirectQuery(boolean 
addRequestUriAsRedirectQuery) {
         this.addRequestUriAsRedirectQuery = addRequestUriAsRedirectQuery;
     }
+
+    /**
+     * Whether the stored ID token must carry an expiry ("exp") claim for the
+     * session context to keep being revalidated. Default is true. Disabling
+     * this re-opens never-expiring sessions for exp-less ID tokens - only do
+     * so if another mechanism bounds the session lifetime.
+     */
+    public void setRequireIdTokenExpiry(boolean requireIdTokenExpiry) {
+        this.requireIdTokenExpiry = requireIdTokenExpiry;
+    }
 }