cxf-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Sergey Beryozkin (JIRA)" <j...@apache.org>
Subject [jira] [Resolved] (CXF-7504) NPE in oauth2 module for jose auth code tokens
Date Fri, 15 Sep 2017 15:34:01 GMT

     [ https://issues.apache.org/jira/browse/CXF-7504?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Sergey Beryozkin resolved CXF-7504.
-----------------------------------
       Resolution: Fixed
         Assignee: Sergey Beryozkin
    Fix Version/s: 3.2.1
                   3.1.14

At some point that code which deals with saving/restoring the properties should be updated
to use JWT claims

> NPE in oauth2 module for jose auth code tokens
> ----------------------------------------------
>
>                 Key: CXF-7504
>                 URL: https://issues.apache.org/jira/browse/CXF-7504
>             Project: CXF
>          Issue Type: Bug
>    Affects Versions: 3.2.0
>            Reporter: Romain Manni-Bucau
>            Assignee: Sergey Beryozkin
>             Fix For: 3.1.14, 3.2.1
>
>
> org.apache.cxf.rs.security.oauth2.provider.JoseSessionTokenProvider#protectStateString
calls org.apache.cxf.rs.security.oauth2.provider.JoseSessionTokenProvider#getInitializedEncryptionProvider
which calls org.apache.cxf.rs.security.jose.jwe.JweUtils#loadEncryptionProvider(org.apache.cxf.rs.security.jose.jwe.JweHeaders,
boolean) with headers == null but in the stack org.apache.cxf.rs.security.jose.jwe.JweUtils#loadKeyEncryptionProvider
assumes headers != null which leads to a NPE



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

Mime
View raw message