rootvector2 commented on code in PR #3652:
URL: https://github.com/apache/cxf/pull/3652#discussion_r4420564582
##########
rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/AbstractOAuthDataProvider.java:
##########
@@ -475,6 +479,8 @@ protected ServerAccessToken doRefreshAccessToken(Client
client,
oldRefreshToken.getGrantType(), oldRefreshToken.getNonce(),
null, theNewScopes, oldRefreshToken.getSubject());
Review Comment:
`doCreateNewRefreshToken` doesn't copy the access token's extra properties,
so a refresh token never carries `x5t#S256` and there's nothing to overwrite.
The create path uses the same order too (registration extra properties first,
then the thumbprint from the current request), so I left it without a comment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
