diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TxTokenService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TxTokenService.java index 8e2fd6a16b3..02f111d0542 100644 --- a/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TxTokenService.java +++ b/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TxTokenService.java @@ -44,6 +44,7 @@ import jakarta.ws.rs.core.MediaType; import jakarta.ws.rs.core.Response; import org.apache.commons.lang3.StringUtils; +import org.json.JSONException; import org.json.JSONObject; import org.slf4j.Logger; @@ -161,25 +162,36 @@ private void fillPayload(JsonWebResponse jwr, String audience, String requestCon jwr.getClaims().addAudience(audience); } - if (StringUtils.isNotBlank(requestContext)) { - requestContext = Base64Util.base64urldecodeToString(requestContext); - jwr.getClaims().setClaim("rctx", new JSONObject(requestContext)); + JSONObject requestContextObj = decodeJson(requestContext); + if (requestContextObj != null) { + jwr.getClaims().setClaim("rctx", requestContextObj); } if (authorizationGrant != null) { jwr.setClaim("sub", authorizationGrant.getSub()); } - JSONObject azd = new JSONObject(); - if (StringUtils.isNotBlank(requestDetails)) { - requestDetails = Base64Util.base64urldecodeToString(requestDetails); - azd = new JSONObject(requestDetails); + JSONObject azd = decodeJson(requestDetails); + if (azd == null) { + azd = new JSONObject(); } azd.put("client_id", client.getClientId()); jwr.getClaims().setClaim("azd", azd); } + private static JSONObject decodeJson(String jsonString) { + if (StringUtils.isBlank(jsonString)) { + return null; + } + try { + return new JSONObject(jsonString); + } catch (JSONException e) { + String decoded = Base64Util.base64urldecodeToString(jsonString); + return new JSONObject(decoded); + } + } + private int getTxTokenLifetime(Client client) { if (client.getAttributes().getTxTokenLifetime() != null && client.getAttributes().getTxTokenLifetime() > 0) { log.trace("Override TxToken lifetime with value {} from client: {}", client.getAttributes().getTxTokenLifetime(), client.getClientId());