This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch 3.6.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 646d9b72b882970ffb0bc99d51061956e2d0a746 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Sep 1 08:28:00 2026 +0100 Require in OidcRpAuthenticationFilter that IdTokens have an expiry (#3424) (cherry picked from commit 639cb574be237b0ba9f3228c35c48008739b5b7e) --- .../security/oidc/rp/OidcRpAuthenticationFilter.java | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java index 530824174b3..28579c9645e 100644 --- a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java +++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcRpAuthenticationFilter.java @@ -55,6 +55,7 @@ public class OidcRpAuthenticationFilter implements ContainerRequestFilter { private String redirectUri; private String roleClaim; private boolean addRequestUriAsRedirectQuery; + private boolean requireIdTokenExpiry = true; public void filter(ContainerRequestContext rc) { if (checkSecurityContext(rc)) { @@ -87,9 +88,13 @@ public class OidcRpAuthenticationFilter implements ContainerRequestFilter { return false; } IdToken idToken = tokenContext.getIdToken(); + if (idToken == null) { + return false; + } try { - // If ID token has expired then the context is no longer valid - JwtUtils.validateJwtExpiry(idToken, 0, idToken.getExpiryTime() != null); + // If ID token has expired then the context is no longer valid. + // OIDC Core mandates "exp" in ID Tokens, so it is required by default. + JwtUtils.validateJwtExpiry(idToken, 0, requireIdTokenExpiry); } catch (JwtException ex) { stateManager.removeClientTokenContext(new MessageContextImpl(JAXRSUtils.getCurrentMessage())); return false; @@ -154,4 +159,14 @@ public class OidcRpAuthenticationFilter implements ContainerRequestFilter { public void setAddRequestUriAsRedirectQuery(boolean addRequestUriAsRedirectQuery) { this.addRequestUriAsRedirectQuery = addRequestUriAsRedirectQuery; } + + /** + * Whether the stored ID token must carry an expiry ("exp") claim for the + * session context to keep being revalidated. Default is true. Disabling + * this re-opens never-expiring sessions for exp-less ID tokens - only do + * so if another mechanism bounds the session lifetime. + */ + public void setRequireIdTokenExpiry(boolean requireIdTokenExpiry) { + this.requireIdTokenExpiry = requireIdTokenExpiry; + } }
