rootvector2 opened a new pull request, #3639: URL: https://github.com/apache/cxf/pull/3639
`JoseJwtConsumer.getJwtToken` returns the decrypted token straight from `JweJwtCompactConsumer.decryptWith` when `jwsRequired=false` and `jweRequired=true`, skipping the `validateToken` hook that `JwtAuthenticationFilter`, `JwtAccessTokenValidator` and `JwtBearerAuthHandler` use for the `exp`, `nbf`, `iat`, `aud` and `iss` checks (found while auditing the JOSE consumers), so an expired or wrong-audience encrypted token was accepted as long as it decrypted, and the fix validates the decrypted token before returning it, with a `JwtAuthenticationFilterTest` case that fails on the unpatched tree. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
