fix(jans-auth-server): clean up jansDeviceSess entries after expiration #8704

[yuriyz]

Description

fix(jans-auth-server): clean up jansDeviceSess entries after expiration

Target issue

closes #8704

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The provided code change in the Jans Authorization Server application focuses on maintaining the application's data integrity and performance by periodically cleaning up expired or inactive entities, including device sessions and inactive clients, and ensuring the application's cache remains up-to-date and efficient.

Expand for full summary

Summary:

The provided code change is related to the CleanerTimer class in the Jans Authorization Server application. The key changes include:

1. Addition of the DeviceSession entity to the list of entities that the CleanerTimer will periodically clean up. This suggests the application now handles device-specific sessions, which is an important security consideration.
2. Improvements to the cleanup process, including batch processing and the ability to clean up inactive clients based on a configurable time threshold. This helps maintain the application's data integrity and performance.
3. Inclusion of a cache cleanup process to ensure the application's cache remains up-to-date and efficient.

From an application security perspective, these changes are focused on maintaining the application's data integrity and performance by periodically removing expired or inactive entities. Ensuring the timely removal of device sessions and inactive clients is crucial to prevent potential security issues, such as unauthorized access or session hijacking. Overall, this code change appears to be a routine maintenance task to keep the application's data clean and secure.

Files Changed:

• jans-auth-server/server/src/main/java/io/jans/as/server/service/CleanerTimer.java: This file contains the changes related to the CleanerTimer class, which is responsible for periodically cleaning up various data entities in the Jans Authorization Server application. The key changes include the addition of the DeviceSession entity to the cleanup process, improvements to the cleanup process (batch processing and inactive client cleanup), and the inclusion of a cache cleanup process.

Code Analysis

We ran 7 analyzers against 1 file and 1 analyzer had findings. 6 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.