From 57e91af16c411c146e174294d08664f21a1edbbc Mon Sep 17 00:00:00 2001 From: Ioannis Kakavas Date: Tue, 17 Mar 2020 16:21:51 +0200 Subject: [PATCH] Fix potential bug in concurrent token refresh support Ensure that we do not proceed execution after calling the listerer's onFailure --- .../org/elasticsearch/xpack/security/authc/TokenService.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java b/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java index c12b14477b8e7..f32a57c1d7533 100644 --- a/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java +++ b/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/TokenService.java @@ -1101,9 +1101,10 @@ void decryptAndReturnSupersedingTokens(String refreshToken, RefreshTokenStatus r if (decryptedTokens.length != 2) { logger.warn("Decrypted tokens string is not correctly formatted"); listener.onFailure(invalidGrantException("could not refresh the requested token")); + } else { + listener.onResponse(new Tuple<>(prependVersionAndEncodeAccessToken(refreshTokenStatus.getVersion(), decryptedTokens[0]), + prependVersionAndEncodeRefreshToken(refreshTokenStatus.getVersion(), decryptedTokens[1]))); } - listener.onResponse(new Tuple<>(prependVersionAndEncodeAccessToken(refreshTokenStatus.getVersion(), decryptedTokens[0]), - prependVersionAndEncodeRefreshToken(refreshTokenStatus.getVersion(), decryptedTokens[1]))); } catch (GeneralSecurityException | IOException e) { logger.warn("Could not get stored superseding token values", e); listener.onFailure(invalidGrantException("could not refresh the requested token"));