[
https://issues.apache.org/jira/browse/CXF-9237?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Colm O hEigeartaigh reassigned CXF-9237:
----------------------------------------
Assignee: Colm O hEigeartaigh
> JCacheOAuthDataProvider.createCache() sets no expiry policy — cache entries
> (incl. expired tokens) are never evicted
> --------------------------------------------------------------------------------------------------------------------
>
> Key: CXF-9237
> URL: https://issues.apache.org/jira/browse/CXF-9237
> Project: CXF
> Issue Type: Bug
> Components: JAX-RS Security
> Affects Versions: 3.6.8, 4.2.1
> Environment: Apache CXF 3.6.8, Java 11+, JCache (JSR-107) backend
> (e.g. ehcache-107).
> Reporter: Guanping Zhang
> Assignee: Colm O hEigeartaigh
> Priority: Major
>
> h3. Problem
> JCacheOAuthDataProvider.createCache() (lines 299-313) builds the client /
> accessToken / refreshToken caches with MutableConfiguration but never calls
> setExpiryPolicyFactory(). Under JSR-107 defaults, entries therefore never
> expire at the cache-infrastructure level. Eexpired tokens are removed by
> neither the application logic nor the cache infrastructure: they persist for
> the lifetime of the process.
> h3. Impact (operational, not a security-boundary bypass)
> Token introspection and refresh re-check expiry via OAuthUtils.isExpired, so
> expired tokens are still rejected at the security boundary; this defect
> therefore does not extend token validity. The impact is unbounded retention
> of expired entries — memory pressure / uncontrolled resource consumption
> (CWE-400) on long-lived authorization servers — and the defeat of any
> expectation of automatic eviction.
> h3. Suggested fix
> Configure a TTL on the caches, e.g.
> cfg.setExpiryPolicyFactory(CreatedExpiryPolicy.factoryOf(new
> Duration(TimeUnit.MILLISECONDS, tokenLifetime * 1000L)));
> (or an AccessedExpiryPolicy aligned with the token lifetime), so the cache
> infrastructure evicts expired entries independently of the application-level
> check.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
