rootvector2 commented on PR #3680: URL: https://github.com/apache/cxf/pull/3680#issuecomment-6702662013
Pushed f8b5658d. 1. `verifyMessage` now resolves both TTLs from the `Message` contextual properties, with values set through `setTimeToLive` / `setFutureTimeToLive` taking precedence. The reading in `AbstractSignatureInFilter.createMessageVerifier()` is gone, so an injected verifier like the one in the systests' `server.xml` picks the properties up too. 2. It now collects every `Date` value (case-insensitive key) and rejects more than one, so it only parses a value when it's the exact string that `mapHeaders` signed. 3. Added an "Important notes" entry to `release_notes.txt` about the default-on behavior and clock skew. The javadoc on `RSSEC_HTTP_SIGNATURE_TIME_TO_LIVE` now says `date` has to be signed and listed in `rs.security.http.signature.in.headers`, that `CreateSignatureInterceptor` doesn't add it by default, and that a message can still be replayed within the window. Minor: both checks are now disabled by `<= 0`, and `createSpecExampleVerifier` disables both. I left the `Signature.fromString` re-parse as is, because returning the parsed `Signature` would change `validate()` on the public `SignatureValidator` interface and break custom implementations. Happy to change it if you'd rather take that. New tests cover the contextual TTL, explicit-over-contextual precedence and multiple `Date` values. The module tests and `JAXRSHTTPSignatureTest` pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
