digst / OIOSAML.Java

Other
11 stars 11 forks source link

Verifying Response Issue instant and Assertion Issue instant is checking for 5 seconds instead of 5 minutes #40

Closed aparnavodapalli closed 2 years ago

aparnavodapalli commented 3 years ago

Below snippet from AssertionValidationService.java in oiosaml3.java code.

 //Check Response Issue instant
        DateTime responseIssueInstant = response.getIssueInstant();
        if (responseIssueInstant.isBefore(DateTime.now().minusSeconds(clockSkew))) {
            throw new AssertionValidationException("Response Lifetime incorrect");
        }

        //Check Assertion Issue instant
        DateTime assertionIssueInstant = assertion.getIssueInstant();
        if (assertionIssueInstant.isBefore(DateTime.now().minusSeconds(clockSkew))) {
            throw new AssertionValidationException("Assertion Lifetime incorrect");
        }