This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/oauth2-encrypted-codedata-provider in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 2ae6fb15b801f26c78307e844e33e90fa48c37dc Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Jul 28 10:50:46 2026 +0100 Honor the set-remove boolean in DefaultEncryptingCodeDataProvider --- .../code/DefaultEncryptingCodeDataProvider.java | 34 ++++++++++++++-------- 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/DefaultEncryptingCodeDataProvider.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/DefaultEncryptingCodeDataProvider.java index 2e576b74d52..3e4c2a8e7e8 100644 --- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/DefaultEncryptingCodeDataProvider.java +++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/code/DefaultEncryptingCodeDataProvider.java @@ -49,15 +49,25 @@ public class DefaultEncryptingCodeDataProvider extends DefaultEncryptingOAuthDat } @Override public Client removeClient(String clientId) { - Client c = super.removeClient(clientId); - removeClientCodeGrants(c); - return c; + // Purge code grants while the client record is still in the store so + // that decryption can look up the client by ID. + Client c = getClient(clientId); + if (c != null) { + removeClientCodeGrants(c); + } + return super.removeClient(clientId); } protected void removeClientCodeGrants(Client c) { - for (ServerAuthorizationCodeGrant grant : getCodeGrants(c, null)) { - removeCodeGrant(grant.getCode()); - } + // The grants set holds encrypted code strings; iterate them directly + // rather than going through removeCodeGrant (which expects the same + // encrypted form) to avoid the mismatch between the encrypted key and + // the plain code embedded in the decrypted payload. + grants.removeIf(encryptedCode -> { + ServerAuthorizationCodeGrant grant = getCodeGrant(encryptedCode); + return grant != null && grant.getClient() != null + && c.getClientId().equals(grant.getClient().getClientId()); + }); } @Override public ServerAuthorizationCodeGrant createCodeGrant(AuthorizationCodeRegistration reg) @@ -84,16 +94,16 @@ public class DefaultEncryptingCodeDataProvider extends DefaultEncryptingOAuthDat @Override public ServerAuthorizationCodeGrant removeCodeGrant(String code) throws OAuthServiceException { - grants.remove(code); + if (!grants.remove(code)) { + return null; + } return ModelEncryptionSupport.decryptCodeGrant(this, code, key); } public ServerAuthorizationCodeGrant getCodeGrant(String code) throws OAuthServiceException { - - ServerAuthorizationCodeGrant grant = ModelEncryptionSupport.decryptCodeGrant(this, code, key); - if (grant != null) { - grants.remove(code); + if (!grants.contains(code)) { + return null; } - return grant; + return ModelEncryptionSupport.decryptCodeGrant(this, code, key); } protected ServerAuthorizationCodeGrant doCreateCodeGrant(AuthorizationCodeRegistration reg)
