Update JwtAccessTokenValidator.java
The token lifetime is incorrectly calculated to a negative value because claims expiry time is in second interval and original code is setting issued at value in millisecond interval.
@@ -41,6 +41,7 @@ import org.apache.cxf.rs.security.oauth2.provider.AccessTokenValidator;
import org.apache.cxf.rs.security.oauth2.provider.OAuthServiceException;
import org.apache.cxf.rs.security.oauth2.utils.JwtTokenUtils;
import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
+import org.apache.cxf.rs.security.oauth2.utils.OAuthUtils;
public class JwtAccessTokenValidator extends JoseJwtConsumer implements AccessTokenValidator {
@@ -76,8 +77,7 @@ public class JwtAccessTokenValidator extends JoseJwtConsumer implements AccessTo
if (claims.getIssuedAt() != null) {
atv.setTokenIssuedAt(claims.getIssuedAt());
} else {
- Instant now = Instant.now();
- atv.setTokenIssuedAt(now.toEpochMilli());
+ atv.setTokenIssuedAt(OAuthUtils.getIssuedAt());
}
if (claims.getExpiryTime() != null) {
atv.setTokenLifetime(claims.getExpiryTime() - atv.getTokenIssuedAt());
