Check expiry of the cached OIDC token introspections #43994
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When the opaque token is introspected remotely, its expiry time is checked and then it can be optionally saved in the token introspection cache. If it goes to the cache then its validity period becomes equal to the cache entry time to live.
This PR checks the token introspection expiry time even when it is cached, and removes it from the cache eagerly if the introspection has expired.
Right now this is only done at the default token introspection cache level, custom ones should be managing expired token introspections themselves.
I've tried to make this PR work even for custom token introspection caches to make it easier for custom caches, but the PR becomes more involved and may not be backportable, as a new TokenIntospectionCache.remove method is required so I'll deal with it later.
Added a test to confirm that when the token introspection has expired, with the cache entry time to live beng significantly larger (tokens are valid for 10 or 3 secs, the cache entry for 3 mins), then the token introspection which is valid for 3 secs will be removed after 5 secs.