Guanping Zhang created CXF-9237:
-----------------------------------
Summary: JCacheOAuthDataProvider.createCache() sets no expiry
policy — cache entries (incl. expired tokens) are never evicted
Key: CXF-9237
URL: https://issues.apache.org/jira/browse/CXF-9237
Project: CXF
Issue Type: Bug
Components: JAX-RS Security
Affects Versions: 4.2.1, 3.6.8
Environment: Apache CXF 3.6.8, Java 11+, JCache (JSR-107) backend
(e.g. ehcache-107).
Reporter: Guanping Zhang
h3. Problem
JCacheOAuthDataProvider.createCache() (lines 299-313) builds the client /
accessToken / refreshToken caches with MutableConfiguration but never calls
setExpiryPolicyFactory(). Under JSR-107 defaults, entries therefore never
expire at the cache-infrastructure level. Eexpired tokens are removed by
neither the application logic nor the cache infrastructure: they persist for
the lifetime of the process.
h3. Impact (operational, not a security-boundary bypass)
Token introspection and refresh re-check expiry via OAuthUtils.isExpired, so
expired tokens are still rejected at the security boundary; this defect
therefore does not extend token validity. The impact is unbounded retention of
expired entries — memory pressure / uncontrolled resource consumption (CWE-400)
on long-lived authorization servers — and the defeat of any expectation of
automatic eviction.
h3. Suggested fix
Configure a TTL on the caches, e.g.
cfg.setExpiryPolicyFactory(CreatedExpiryPolicy.factoryOf(new
Duration(TimeUnit.MILLISECONDS, tokenLifetime * 1000L)));
(or an AccessedExpiryPolicy aligned with the token lifetime), so the cache
infrastructure evicts expired entries independently of the application-level
check.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
