rootvector2 commented on PR #3625: URL: https://github.com/apache/cxf/pull/3625#issuecomment-6394128005
Not the same code path. #3622 only touched the WS-Security `JCacheReplayCache` in `rt/ws/security` (the WSS4J `ReplayCache.addIfAbsent` override). The JAX-RS SAML SSO module has its own `TokenReplayCache` interface with separate `EHCacheTokenReplayCache` / `JCacheTokenReplayCache` implementations, and `SAMLSSOResponseValidator.validateSubjectConfirmation` on main still does `replayCache.contains(id)` followed by `replayCache.putId(id, expires)`, so concurrent POSTs of the same captured response are all accepted. I found it while checking whether the SSO side had the same pattern after #3622. This PR is the equivalent fix for that module: `TokenReplayCache.putIdIfAbsent` backed by `putIfAbsent` in both caches, and the validator switched over to it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
