Skip to content

Do not reuse the same refresh token multiple times #1309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Do not reuse the same refresh token multiple times #1309

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 38 additions & 26 deletions ...eactor/src/main/java/org/cloudfoundry/reactor/tokenprovider/AbstractUaaTokenProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ public abstract class AbstractUaaTokenProvider implements TokenProvider {
private final ConcurrentMap<ConnectionContext, RefreshToken> refreshTokenStreams =
new ConcurrentHashMap<>(1);

private final ConcurrentMap<ConnectionContext, Mono<String>> refreshTokens =
private final ConcurrentMap<ConnectionContext, String> refreshTokens =
new ConcurrentHashMap<>(1);

/**
Expand Down Expand Up @@ -116,7 +116,10 @@ public final Mono<String> getToken(ConnectionContext connectionContext) {

@Override
public void invalidate(ConnectionContext connectionContext) {
this.accessTokens.put(connectionContext, token(connectionContext));
String refreshToken = this.refreshTokens.remove(connectionContext);
if (refreshToken != null) {
this.accessTokens.put(connectionContext, token(connectionContext, refreshToken));
}
}

/**
Expand All @@ -133,6 +136,30 @@ public void invalidate(ConnectionContext connectionContext) {
*/
abstract void tokenRequestTransformer(HttpClientRequest request, HttpClientForm form);

private Mono<String> token(ConnectionContext connectionContext) {
Mono<String> token =
primaryToken(connectionContext)
.doOnSubscribe(s -> LOGGER.debug("Negotiating using token provider"));

return cacheResult(connectionContext, token);
}

private Mono<String> token(ConnectionContext connectionContext, String refreshToken) {
Mono<String> token =
refreshToken(connectionContext, refreshToken)
.doOnSubscribe(s -> LOGGER.debug("Negotiating using refresh token"))
// fall back to primary token in case the refresh_token grant fails
// (expired, revoked, ...)
.switchIfEmpty(
primaryToken(connectionContext)
.doOnSubscribe(
s ->
LOGGER.debug(
"Falling back to token provider")));

return cacheResult(connectionContext, token);
}

private static String extractAccessToken(Map<String, String> payload) {
String accessToken = payload.get(ACCESS_TOKEN);

Expand Down Expand Up @@ -227,8 +254,7 @@ private Consumer<Map<String, String>> extractRefreshToken(ConnectionContext conn
});
}

this.refreshTokens.put(
connectionContext, Mono.just(refreshToken));
this.refreshTokens.put(connectionContext, refreshToken);
getRefreshTokenStream(connectionContext)
.sink
.emitNext(refreshToken, FAIL_FAST);
Expand Down Expand Up @@ -297,30 +323,16 @@ private void setAuthorization(HttpHeaders headers) {
headers.set(AUTHORIZATION, String.format("Basic %s", encoded));
}

private Mono<String> token(ConnectionContext connectionContext) {
Mono<String> cached =
this.refreshTokens
.getOrDefault(connectionContext, Mono.empty())
.flatMap(
refreshToken ->
refreshToken(connectionContext, refreshToken)
.doOnSubscribe(
s ->
LOGGER.debug(
"Negotiating using refresh"
+ " token")))
.switchIfEmpty(
primaryToken(connectionContext)
.doOnSubscribe(
s ->
LOGGER.debug(
"Negotiating using token"
+ " provider")));

/**
* Cache the given mono. If {@link ConnectionContext#getCacheDuration()} is not null, use that
* as the cache TTL. Otherwise, cache indefinitely.
*/
private static Mono<String> cacheResult(
ConnectionContext connectionContext, Mono<String> token) {
return connectionContext
.getCacheDuration()
.map(cached::cache)
.orElseGet(cached::cache)
.map(token::cache)
.orElseGet(token::cache)
.checkpoint();
}

Expand Down