Check the expiry date for inactive OIDC tokens

quarkusio · Mar 13, 2023 · f16e383 · f16e383
1 parent 48032c6
commit f16e383
Showing 1 changed file with 13 additions and 8 deletions.
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProvider.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProvider.java
@@ -227,16 +227,10 @@ public TokenIntrospection apply(TokenIntrospection introspectionResult, Throwabl
                         }
                         if (!Boolean.TRUE.equals(introspectionResult.getBoolean(OidcConstants.INTROSPECTION_TOKEN_ACTIVE))) {
                             LOG.debugf("Token issued to client %s is not active", oidcConfig.clientId.get());
+                            verifyTokenExpiry(introspectionResult.getLong(OidcConstants.INTROSPECTION_TOKEN_EXP));
                             throw new AuthenticationFailedException();
                         }
-                        if (isTokenExpired(introspectionResult.getLong(OidcConstants.INTROSPECTION_TOKEN_EXP))) {
-                            String error = String.format("Token issued to client %s has expired",
-                                    oidcConfig.clientId.get());
-                            LOG.debugf(error);
-                            throw new AuthenticationFailedException(
-                                    new InvalidJwtException(error,
-                                            List.of(new ErrorCodeValidator.Error(ErrorCodes.EXPIRED, error)), null));
-                        }
+                        verifyTokenExpiry(introspectionResult.getLong(OidcConstants.INTROSPECTION_TOKEN_EXP));
                         try {
                             verifyTokenAge(introspectionResult.getLong(OidcConstants.INTROSPECTION_TOKEN_IAT));
                         } catch (InvalidJwtException ex) {
@@ -246,6 +240,17 @@ public TokenIntrospection apply(TokenIntrospection introspectionResult, Throwabl
                         return introspectionResult;
                     }
 
+                    private void verifyTokenExpiry(Long exp) {
+                        if (isTokenExpired(exp)) {
+                            String error = String.format("Token issued to client %s has expired",
+                                    oidcConfig.clientId.get());
+                            LOG.debugf(error);
+                            throw new AuthenticationFailedException(
+                                    new InvalidJwtException(error,
+                                            List.of(new ErrorCodeValidator.Error(ErrorCodes.EXPIRED, error)), null));
+                        }
+                    }
+
                 });
     }