[java-idp-oidc] 03/03: JOIDC-286 - Improve logging for expired sealed tokens

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-oidc/commit/d032c4445ddcafdacfa66edb847be6565bfa067e

commit d032c4445ddcafdacfa66edb847be6565bfa067e
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Sep 14 17:24:27 2026 +0300

    JOIDC-286 - Improve logging for expired sealed tokens
    
    https://shibboleth.atlassian.net/browse/JOIDC-286
    
    Improve logging for the expired opaque refresh tokens
---
 .../idp/plugin/oidc/op/profile/impl/UnwrapGrant.java     | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/UnwrapGrant.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/UnwrapGrant.java
index 7b5d86b1..047abde9 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/UnwrapGrant.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/UnwrapGrant.java
@@ -151,8 +151,14 @@ public class UnwrapGrant extends AbstractOIDCTokenResponseAction {
                     && refreshTokentokenGrant.getRefreshToken().getValue() != null) {
                 final String tokenValue = refreshTokentokenGrant.getRefreshToken().getValue();
                 assert tokenValue != null;
-                final RefreshTokenClaimsSet refreshTokenClaimsSet = deserializeRefreshToken(profileRequestContext,
-                        tokenValue);
+                final RefreshTokenClaimsSet refreshTokenClaimsSet;
+                try {
+                    refreshTokenClaimsSet = deserializeRefreshToken(profileRequestContext, tokenValue);
+                } catch (final DataExpiredException e) {
+                    log.info("{} Incoming opaque refresh token has expired", getLogPrefix());
+                    ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
+                    return;
+                }
                 if (refreshTokenClaimsSet == null) {
                     log.warn("{} Unwrapping refresh token failed", getLogPrefix());
                     ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
@@ -202,11 +208,15 @@ public class UnwrapGrant extends AbstractOIDCTokenResponseAction {
      * @param profileRequestContext The profile request context given to the deserializers
      * @param refreshToken The serialized refresh token value
      * @return refresh token claims set, or null if it couldn't be parsed
+     * @throw DataExpiredException if the opaque refresh token has expired
      */
     protected RefreshTokenClaimsSet deserializeRefreshToken(@Nonnull final ProfileRequestContext profileRequestContext,
-            @Nonnull final String refreshToken) {
+            @Nonnull final String refreshToken) throws DataExpiredException {
         try {
             return RefreshTokenClaimsSet.parse(refreshToken, dataSealer);
+        } catch (final DataExpiredException e) {
+            log.debug("{} Incoming opaque refresh token has expired", getLogPrefix(), e);
+            throw e;
         } catch (ParseException | DataSealerException e) {
         }
         for (final BiFunction<ProfileRequestContext, String, RefreshTokenClaimsSet> deserializer : 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.