Assert minimum JWT expiration time

2026-03-01 01:40:50 +01:00 · 2025-03-07 12:01:57 +01:00
parent f1c83ef113
commit 9be59bd83f
1 changed files with 4 additions and 0 deletions
--- a/scm-webapp/src/main/java/sonia/scm/security/JwtAccessTokenBuilder.java
+++ b/scm-webapp/src/main/java/sonia/scm/security/JwtAccessTokenBuilder.java
@@ -173,6 +173,10 @@ public final class JwtAccessTokenBuilder implements AccessTokenBuilder {
    // add scope to custom claims
    Scopes.toClaims(customClaims, scope);

+    if (expiresIn < 1) {
+      expiresIn = 1;
+    }
+
    Instant now = clock.instant();
    long expiration = expiresInUnit.toMillis(expiresIn);