Skip to content
This repository has been archived by the owner on May 31, 2022. It is now read-only.

RedisTokenStore should delete access_to_refresh key when removing refresh token #1836

Closed
mashice opened this issue Mar 14, 2020 · 1 comment
Closed

RedisTokenStore should delete access_to_refresh key when removing refresh token #1836

mashice opened this issue Mar 14, 2020 · 1 comment
Assignees
@jgrandja
Labels
in: oauth2 status: backported type: bug
Milestone
2.5.0.RC1

Comments

@mashice
Copy link

mashice commented Mar 14, 2020

https://github.com/spring-projects/spring-security-oauth/blob/d72922e395aa9c2fd0fd5b2de2e557790c2b92c5/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/token/store/redis/RedisTokenStore.java#L364

in line 364 want to delete refreshToken, redis key is ACCESS_TO_REFRESH + refreshToken, but in line 213 save key as ACCESS_TO_REFRESH + accessToken.

image
image
@mashice mashice changed the title isRedisTokenStore removeRefreshToken bug RedisTokenStore removeRefreshToken bug Mar 14, 2020
@srempfer
Copy link

The storing part is correct but the access2RefreshKey is calculated wrong for removing part.

Scenario 1: => no key is left behind

  1. removeAccessToken
  2. removeRefreshToken

Scenario 2: => no key is left behind

  1. removeRefreshToken
  2. removeAccessToken

Scenario 3: => key for access_to_refresh is left behind

  1. removeRefreshToken

I develop currently a test and fix for that. PR will follow...

srempfer pushed a commit to srempfer/spring-security-oauth that referenced this issue Apr 16, 2020
RedisTokenStore - delete also 'access_to_refresh' key when removing a…
1f3097a 
… refresh token (fixes spring-atticgh-1836)
srempfer pushed a commit to srempfer/spring-security-oauth that referenced this issue Apr 16, 2020
RedisTokenStore - delete also 'access_to_refresh' key when removing a…
bae6b2d 
… refresh token (fixes spring-atticgh-1836)
@srempfer srempfer mentioned this issue Apr 16, 2020
Closed
srempfer pushed a commit to srempfer/spring-security-oauth that referenced this issue Apr 16, 2020
RedisTokenStore - delete also 'access_to_refresh' key when removing a…
0aeae9a 
… refresh token (fixes spring-atticgh-1836)
srempfer pushed a commit to srempfer/spring-security-oauth that referenced this issue Apr 21, 2020
RedisTokenStore - delete also 'access_to_refresh' key when removing a…
d8763a2 
… refresh token (fixes spring-atticgh-1836)
@jgrandja jgrandja self-assigned this Apr 30, 2020
@jgrandja jgrandja added this to the 2.5.0.RC1 milestone Apr 30, 2020
@jgrandja jgrandja changed the title RedisTokenStore removeRefreshToken bug RedisTokenStore should delete access_to_refresh key when removing refresh token Apr 30, 2020
@jgrandja jgrandja mentioned this issue Apr 30, 2020
Closed
jgrandja pushed a commit that referenced this issue Apr 30, 2020
@jgrandja
Delete access_to_refresh key when removing refresh token in RedisToke…
a72e2b7 
…nStore

Fixes gh-1836
@jgrandja jgrandja mentioned this issue Feb 25, 2021
Closed
@nl594 nl594 mentioned this issue Mar 26, 2022
Open
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@jgrandja jgrandja

Labels
in: oauth2 status: backported type: bug
Milestone
2.5.0.RC1
4 participants
@srempfer @jgrandja @spring-projects-issues @mashice