jans
jans copied to clipboard
feat(jans-auth-server): Reduce JWT access token lifetime if UpdateToken` interception script is present.
Is your feature request related to a problem? Please describe.
I use a custom UpdateToken
interception script which overwrites getAccessTokenLifetimeInSeconds
. As long as I used an opaque access token, this worked as expected. As soon as I switched to a JWT access token for a client, the return value of getAccessTokenLifetimeInSeconds
was ignored in favour of the lifetime of the access token verification keys. This led to a problem where I cleaned up some states under the impression that no valid access token exists that may use it. Further, the shortened lifetimes are an essential feature of the built system
Describe the solution you'd like If 'getAccessTokenLifetimeInSeconds' is present and a JWT access token is used, the lifetime should be the minimum of 'getAccessTokenLifetimeInSeconds' and the lifetime of the JWT access token's verification keys.
Describe alternatives you've considered I considered not allowing JWT access tokens in my setup. However, the rest of the system would support them. The shortened lifetimes are essential, and accepting longer lifetimes is not an option.
Additional context
The function that calculates the access token lifetime seems to be getAccessTokenLifetimeInSeconds
of the class io.jans.as.server.model.common.AbstractAuthorizationGrant