JwtTimeStampValidator uses wrong error on token expiration

[jason076]

Summary

I think the JwtTimeStampValidator uses the wrong error type when a token expires:

spring-security/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtTimestampValidator.java

Line 93 in 339a053

return new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST, reason,

As listed in https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 it should use INVALID_TOKEN error.

Actual Behavior

JwtTimeStampValidator uses INVALID_REQUEST error when a token expires

Expected Behavior

JwtTimeStampValidator should uses INVALID_TOKEN error when a token expires

Version

5.5.2

Sample

spring-security/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtTimestampValidator.java

Line 93 in 339a053

return new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST, reason,

[jzheaux]

Thanks for the report, @jason076. This has now been fixed in main and backported to 5.5.x.