jans icon indicating copy to clipboard operation
jans copied to clipboard

feat(jans-auth-server): Reduce JWT access token lifetime if UpdateToken` interception script is present.

Open tawaren opened this issue 4 months ago • 1 comments

Is your feature request related to a problem? Please describe. I use a custom UpdateToken interception script which overwrites getAccessTokenLifetimeInSeconds. As long as I used an opaque access token, this worked as expected. As soon as I switched to a JWT access token for a client, the return value of getAccessTokenLifetimeInSeconds was ignored in favour of the lifetime of the access token verification keys. This led to a problem where I cleaned up some states under the impression that no valid access token exists that may use it. Further, the shortened lifetimes are an essential feature of the built system

Describe the solution you'd like If 'getAccessTokenLifetimeInSeconds' is present and a JWT access token is used, the lifetime should be the minimum of 'getAccessTokenLifetimeInSeconds' and the lifetime of the JWT access token's verification keys.

Describe alternatives you've considered I considered not allowing JWT access tokens in my setup. However, the rest of the system would support them. The shortened lifetimes are essential, and accepting longer lifetimes is not an option.

Additional context The function that calculates the access token lifetime seems to be getAccessTokenLifetimeInSeconds of the class io.jans.as.server.model.common.AbstractAuthorizationGrant

tawaren avatar Oct 15 '24 10:10 tawaren