[java-idp-oidc] 02/03: JOIDC-286 - Improve logging for expired sealed tokens

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch maint-4.3
in repository java-idp-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-oidc/commit/92aad4d4ae4bfc9a45de6ffab6597d5431ccd7fc

commit 92aad4d4ae4bfc9a45de6ffab6597d5431ccd7fc
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Sep 14 17:27:08 2026 +0300

    JOIDC-286 - Improve logging for expired sealed tokens
    
    https://shibboleth.atlassian.net/browse/JOIDC-286
    
    Improve logging for the expired opaque refresh tokens
    
    Corresponds to the commit d032c4445ddcafdacfa66edb847be6565bfa067e on main branch, but done on separate commit here (maint-4.3) as JOIDC-255 had modified the structure
---
 .../idp/plugin/oidc/op/profile/impl/ValidateGrant.java | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
index e0d8da36..1afc0213 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateGrant.java
@@ -348,8 +348,14 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
                     && refreshTokentokenGrant.getRefreshToken().getValue() != null) {
                 final String tokenValue = refreshTokentokenGrant.getRefreshToken().getValue();
                 assert tokenValue != null;
-                final RefreshTokenClaimsSet refreshTokenClaimsSet = deserializeRefreshToken(profileRequestContext,
-                        tokenValue);
+                final RefreshTokenClaimsSet refreshTokenClaimsSet;
+                try {
+                    refreshTokenClaimsSet = deserializeRefreshToken(profileRequestContext, tokenValue);
+                } catch (final DataExpiredException e) {
+                    log.info("{} Incoming opaque refresh token has expired", getLogPrefix());
+                    ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
+                    return;
+                }
                 if (refreshTokenClaimsSet == null) {
                     log.warn("{} Unwrapping refresh token failed", getLogPrefix());
                     ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
@@ -492,11 +498,15 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
      * @param profileRequestContext The profile request context given to the deserializers
      * @param refreshToken The serialized refresh token value
      * @return refresh token claims set, or null if it couldn't be parsed
+     * @throw DataExpiredException if the opaque refresh token has expired
      */
     protected RefreshTokenClaimsSet deserializeRefreshToken(@Nonnull final ProfileRequestContext profileRequestContext,
-            @Nonnull final String refreshToken) {
+            @Nonnull final String refreshToken) throws DataExpiredException {
         try {
             return RefreshTokenClaimsSet.parse(refreshToken, dataSealer);
+        } catch (final DataExpiredException e) {
+            log.debug("{} Incoming opaque refresh token has expired", getLogPrefix(), e);
+            throw e;
         } catch (ParseException | DataSealerException e) {
         }
         for (final BiFunction<ProfileRequestContext, String, RefreshTokenClaimsSet> deserializer : 
@@ -526,4 +536,4 @@ public class ValidateGrant extends AbstractOIDCTokenResponseAction {
         return revocationCache.revoke(RevocationCacheContexts.AUTHORIZATION_CODE, id, lifetime);
     }
     
-}
\ No newline at end of file
+}

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.